WO2016071702A1 - Method and system of registering and authenticating a user of an online service - Google Patents

Method and system of registering and authenticating a user of an online service Download PDF

Info

Publication number
WO2016071702A1
WO2016071702A1 PCT/GB2015/053365 GB2015053365W WO2016071702A1 WO 2016071702 A1 WO2016071702 A1 WO 2016071702A1 GB 2015053365 W GB2015053365 W GB 2015053365W WO 2016071702 A1 WO2016071702 A1 WO 2016071702A1
Authority
WO
WIPO (PCT)
Prior art keywords
user
online service
positions
matrix
authentication
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/GB2015/053365
Other languages
French (fr)
Inventor
Jonathan Geoffrey Milton Craymer
Jonathan Andrew BEAL
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Bigger Sales Co Ltd
Original Assignee
Bigger Sales Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Bigger Sales Co Ltd filed Critical Bigger Sales Co Ltd
Publication of WO2016071702A1 publication Critical patent/WO2016071702A1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3228—One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/36—User authentication by graphic or iconic representation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H04L63/0838—Network architectures or network communication protocols for network security for authentication of entities using passwords using one-time-passwords

Definitions

  • the method of the present invention relates to the use of passwords to register and authenticate users of an online service, in particular the present invention provides an improved method of registering and authenticating users using pattern authentication technology whereby the authentication may be significantly faster than prior art methods.
  • An online service may be any web-based service that requires users to securely log-in.
  • internet banking services and online forums are online services according to the present application.
  • the present invention is one of a number of solutions employing pattern authentication technology in the authentication process.
  • This authentication uses a matrix of elements (which may be numbers, letters, pictures etc) and involves the user proving his identity by extracting and then inputting a predetermined sequence of those elements from the matrix in the correct order, in effect creating an one time password from those elements.
  • pattern authentication technoiogy generally comprises the following steps;
  • a user Upon registering with an online service a user will be required to define a password in the form of a pattern authentication secret, typically this is a sequence of positions in a matrix.
  • a pattern authentication secret typically may comprise a sequence of 8 positions in that matrix, Both the sequence end the specific positions make up the pattern authentication secret. The user will memorise their pattern authentication secret.
  • an authentication engine converts the pattern authentication secret into a complex passcode able to be used in an authentication process. It does this by encoding the pattern authentication secret into 10 ASCII characters, which are sent to the online service to be hashed and stored in the conventional way, typically using oneway cryptographic hashing. Thus the only unencrypted record of a user's pattern authentication secret is in the memory of the user. Neither the authentication engine nor the online service store any raw (unencrypted) user data or passwords, and the authentication engine does not store any customer data.
  • the pattern authentication display will consist of a matrix of elements containing pseudo-random characters for example, a 8x6 matrix with one of six characters (eg. the numbers 0-5) in each position wherein each character is used 8 times,
  • the pattern authentication display will be locally generated, for exampie by the user's browser, using user specific information such as device ID (eg. ME ⁇ number on a phone), a session token obtained from the authentication engine and a time-stamp that will be encrypted within the matrix.
  • the user then generates a one time password by inputting the sequence of characters from the pattern authentication display corresponding to their memorised pattern authentication secret, That is, the one time password will be the sequence of characters read from the pattern authentication display where their pattern authentication secret resides.
  • the form containing the one time password, the session token, and any additional user information, such as the device ID, is then sent to the online service.
  • the online service forwards this form data to the authentication engine which converts the one time password back into a standard password, allowing the online service to authenticate the user, !n other words the authentication engine performs the function of a deciphering engine.
  • the authentication engine acts as a deciphering engine in the following way:
  • the authentication engine Using the same user-specific information (eg. device ID, session token, time- stamp), the authentication engine independently re-creates the pattern authentication display, and using the one time password it calculates all the possible combinations that match the pattern authentication secret. This can take a significant amount of time and/or processing power. For example, in the 6x8 matrix set out above, there are 46,856 possible combinations. Checking all of these combinations typically takes up to 10 seconds or more on many systems. The authentication engine cycles through each combination, hashing each potential pattern authentication secret, until it matches the correct password hash obtained from the online sen/ice.
  • the resulting pattern authentication secret is converted back into a password and returned to the online service to authenticate the user in the normal way.
  • the online service will check the user credentials and, if they are correct, will grant authentication to the user.
  • pattern authentication there is one particular issue with the current methods of implementation.
  • the number of potentially valid pattern authentication secret combinations that must be checked in order to authenticate a user can be excessive.
  • an existing pattern authentication technology presents a user with a 8x6 matrix containing a restricted character set of only 6 characters and the user will have a memorable pattern sequence that is 8 characters iong. Therefore, in order to authenticate a user, the authentication engine will have to check up to 48,858 combinations of pattern authentication secret in order to determine whether the correct one time password was entered. This can be extremely onerous, particularly if a large number of authentication requests from different users are received.
  • the number of combinations required to be checked can be reduced by reducing the character set of the matrix, or by reducing the length of the pattern authentication secret, or by reducing the size of the matrix.
  • ail of these options also reduce the security of the method, it has been desirable to reduce the number of combinations that are required to be checked without reducing any of these variables.
  • One way of doing this was proposed in GB1214200.6 and comprises splitting up the pattern authentication secret into segments and checking each segment against a different hash separately. However, this system is cumbersome and is not considered ideal.
  • the present invention provides a method of authenticating a user of an online service comprising the steps of:
  • a pre-defined user code is utilised to decipher the pre-determined positions.
  • the method of the present invention operates in substantially the same manner as that set out above in the background to the invention.
  • the method is designed to be implemented by an online service using an authentication engine.
  • the ordered set of pre-determined positions is the user's pattern authentication secret and the generated matrix of elements is the pattern authentication display.
  • the essential features of the invention are those set out in claim 1 and that the skilled person may be able to implement the method of claim 1 in ways other than that set out in the background section of the present application. Nevertheless for the remainder of the specification the terminology set out in the background section will be used to describe the present invention.
  • the present invention is advantageous over thai method in that it uses a stored pre-defined user code to enable quicker deciphering of a user pattern authentication secret, in particular, a pre-defined user code is e security option that enables quicker deciphering by reducing the number of combinations that are needed to be checked. Different users may have different pre-defined user codes.
  • a user code will be generated for each user during the registration process in accordance with a method according to the present invention, as set out below. That is, when a user first signs up to the online service.
  • the user code will be generated by an authentication engine and stored in encrypted form by the online service and not stored by the authentication engine. It will then be provided to the authentication engine with the one time password and any other information about the user, such as the device ID when an authentication request is made.
  • the pre-defined user code may form part of a user token that is kept to identify a user during authentication and contains further information about a user.
  • an encrypted user code will only be able to be decrypted by the authentication engine and not by the online service.
  • the user code may comprise a generalised location of each of the predetermined positions.
  • the user code may contain information about each of the predetermined positions to indicate within which of a limited set of positions within the matrix that each position is located. The limited set of positions will be less than the total number of positions within the matrix but greater than one.
  • the user code may contain information about which quadrant of the matrix each of the predetermined positions is located in.
  • the user code may contain information about which set of four positions each of the predetermined positions is located in.
  • the user code may contain information indicating that each specific position of the predetermined positions is located in one of four positions.
  • the user code may also comprise information about the order of the pre ⁇ de ⁇ ermined positions,
  • a user code of the method of the present invention may comprise a combination of any of the information set out above. Additionally or alternatively a user code may comprise any other information about a user's pattern authentication secret that reduces the number of combinations that are required to be checked by the authentication engine,
  • the pre-defined user code acts as a further security measure. This is despite the fact that the use of a pre-defined user code reduces the number of combinations that are needed to be checked by the authentication engine, if the wrong pre-defined user code is used when the combinations are checked the authentication engine will check the wrong combinations and will not be able to authenticate the user.
  • the present invention also provides a system for operating the method of the present invention,
  • the system comprising an online service, an authentication engine and a plugin module.
  • the authentication method of the present invention may operate in the following manner.
  • a previously registered user of the online service will access a website of the online service and be presented with a log in form including a matrix containing a plurality of positions,
  • the user will input their account details, such as user name or email address, and provide an input giving an indication of a subset of the matrix elements corresponding to an ordered set of predetermined positions within the matrix. That input will be a string of matrix elements corresponding to their previously registered ordered set of predetermined positions within the matrix (see below) i.e. the matrix elements corresponding to the user's password or pattern authentication secret.
  • the online service will send the input along with user identifying information, a previously generated hashed user password, and a previously generated user code (see below) to an authentication engine.
  • the authentication engine wiil recreate the matrix presented to the user from the information supplied by the oniine service.
  • the authentication engine will then iterate through the possible patterns that could have been entered based on the matrix presented to the user and the user code, hashing each pattern and comparing it with the previously generated hashed user password. If the authentication engine finds a pattern that matches the user password the user is authorised. If a pattern is not found the user is not authorised.
  • the present invention also provides a method of registering a new user of a secure online service comprising the steps of:
  • the password is an encoding of the ordered set of positions; and the pre-defined user code is an encrypted string containing generalized information regarding the ordered set of positions.
  • each new user of the oniine service is registered with the online service and for a password and user code for that user to be generated.
  • this is done using the method of registering a new user according to the present invention.
  • the method is beneficial as it uses a fairly conventional registration experience for a user to generate an appropriate password and, importantly, a pre-defined user code for the user.
  • the password of the method of registering a new user is the pattern authentication secret of the method of authenticating a user according to the present invention.
  • the user code of a method of registering a user according to the present invention may have any of the features of the method of authenticating a user according to the present invention, as set out above. In order for a method of registering a user according to the present invention to be used with a method of authenticating a user according to the present invention it is necessary that the user code of both methods has the same features.
  • the matrix of a method of registering a user according to the present invention may have any of the features of the method of authenticating a user according to the present invention, as set out above, in order for a method of registering a user according to the present invention to be used with a method of authenticating a user according to the present invention it is necessary that the matrix of both methods has the same features.
  • the method of registering a user may further comprise an initial step of providing the user with a one-time link to access the subsequent method steps. That is, a new user may access the method of registering a user using a substantially conventional process whereby they input their details into the online service and are then sent a one-time fink to allow them to access the steps necessary to generate their password (pattern authentication secret) and user code. It is understood that the skilled person will be well acquainted with this process.
  • the method of registering a new user according to the present invention is implemented using an authentication engine that is remote to the online service, in particular, it is preferable that the user code is generated by an authentication engine that is remote to the online service and the password (pattern authentication secret) is encoded by the online service.
  • a user code may be generated according to security parameters pre-defined for the online service on the basis of the efficiency required for the method of authenticating a user.
  • a more precise user code i.e. one that contains more information about the user's password (pattern authentication secret), will result in a user being abie to be authenticated more quickly, whilst a less precise user code will result in a user being authenticated more slowly.
  • a user code is encrypted and then stored by the online service in a secure database.
  • the password pattern authentication secret of a user is hashed and stored by the online service in a secure database.
  • the method of registering a user may be operated using any appropriate system.
  • a system for registering a new user of a secure online service, operating the method set out above may comprise: the online service and an authentication engine remote to the online service.
  • the method of registering a user according to the present invention may operate in the following manner.
  • a user When a user wants to register with an online service they will enter a website of the online service and be presented with a new user registration form. That registration form will allow them to input their user details, which may include username, email address and any other relevant personal information. The user will input the necessary details and submit thern to the online service. The user will then be sent a one-time link by email that they must use to access the online service and thereby validate their email address.
  • the user will be asked to follow a registration process.
  • they will be presented with a matrix containing a plurality of positions and they will be asked to enter a pattern by indicating an ordered set of positions within the matrix. For example, this can be done by clicking on the relevant positions in the matrix in order.
  • the user will then be asked to confirm the ordered set of positions within the matrix and that they are happy with their choice, This ordered set of positions then forms the user's password or pattern authentication secret.
  • the online service will then send the password (pattern authentication secret) to an authentication engine along with user identifying information, such as a device id of the user and the time of creation.
  • the authentication engine will then encode the password (pattern authentications secret), for example this may be a 10 character base64 encoding of the ordered set of positions.
  • the password may then be hashed with a salt, for example using SHA512, and then stored in a secure database by the online service,
  • the authentication engine will also generate a user code for the user.
  • the user code will contain generaiised information regarding the user's password although it may also contain other user information. After generation the user code will be encrypted and then stored by the online service in a secure database.
  • Figure 1 is a sequence diagram of the online service registration and association process of the specific embodiment of the present invention.
  • Figure 2 is sequence diagram showing the process of registering or changing a user of the specific embodiment of the present invention
  • FIG. 3 is a sequence diagram showing the user authentication of the specific embodiment of the present invention.
  • Figure 4 is a sequence diagram showing a user transaction authorisation of the specific embodiment of the present invention.
  • the system is designed to function under high demand, serving multiple and concurrent connections.
  • the system piatform is a scalable resource that can increase application instances when demand increases.
  • the system is implemented using a queue manager that distributes service requests across the available resource. The queue manager controls the demand using tokens to identify the requests.
  • the system comprises an online service (the client application), an authentication engine (the resource server) and an authorization server (may be integrated with the resource server).
  • the online service has an SSL public key certificate installed and enabled, end allows secure communication using https.
  • the authentication engine has an SSL public key certificate instai!ed and enabled, and allows secure communication using https.
  • the authorization server has an SSL public key certificate installed and enabled, and allows secure communication using https.
  • the authentication engine is only available to registered online services. Upon initial use, an online service will register with the authorization server using a service registration process, This is illustrated in Figure 1.
  • the authorization server establishes a provider key and a provider secret. The process and requirements for provisioning these are by use of a plugin module that manages communication with the a u t h o r iza t i o n s e rve r a n d t h e authentication engine via an application programming interface (API),
  • API application programming interface
  • a provider key is used to identify the online service.
  • the provider secret is a shared secret that is used to verify the online service's identity.
  • the online service When an online service wishes to register to use the authentication engine resource, the online service will become authenticated and associated with the authorization server by using the provider key that is sent from the online service to the authentication engine.
  • the authorization server then sends an access token to the online service which is stored and used to communicate directly with the authentication engine.
  • the access token is vaiid for a fixed period and is routinely renewed.
  • the online service When a user makes an authentication request to the online service, the online service will become authenticated and associated with the authentication engine by using the access token that is sent from the online service to the authentication engine.
  • the authentication engine then sends a session token to the online service.
  • the session token is only valid throughout a single user authentication process and is used to authorize a request.
  • the system can be used for new user registration and if an existing user forgets their usemame or password. This is illustrated in Figure 2 and described below.
  • a user with administrative privileges When a new user is registered a user with administrative privileges will send a user registration request to the online service.
  • the online service will use its standard user registration process to create a new user and send a one-time login link via email to the new user.
  • a mandatory change pattern authentication secret (PAS) form When the new user receives the email and clicks the one-time login link, a mandatory change pattern authentication secret (PAS) form will be presented.
  • PAS change pattern authentication secret
  • the online service When a user forgets their username or password the online service will use a standard change password process to change the user's password and send a one-time login link via email to the user. When the user receives the email and ciicks the one-time login link, a mandatory change pattern authentication secret form will be presented.
  • the online service will then receive a user change/register pattern authentication secret request from the authenticated and associated user (i.e. they have successfully logged in using the one-time login link from their email).
  • the online service will then send a change/register pattern authentication secret form to the user.
  • the user will follow instructions to create their own pattern authentication secret, enter the pattern authentication secret a second time or watch it p layed back and then test their pattern authentication secret by entering a onetime password (one time password) using a test pattern authentication display (pattern authentication display).
  • the user will then submit the form, sending the form data, including the pattern authentication secret, to the online service.
  • the online service will authenticate with the authentication engine and request a session token.
  • the new pattern authentication secret is sent together with the u s e r registration details from the online service to the authentication engine.
  • the authentication engine will generate a new standard password coded from the pattern authentication secret and send it to the online service.
  • the online service will perform a standard change password process using the password provided by the authentication engine.
  • the online service will send the session token and a new hash-salted password to the authentication engine.
  • the authentication engine will then create a user token for the user, which contains the user code, encrypt the token and send this encrypted user token to the online service to be stored.
  • the process of authenticating and associating a user is shown in Figure 3 and described below.
  • the online service may receive e user authentication request from a user.
  • the online service will then authenticate with the authentication engine and request a session token.
  • the online service will send a login form to the user, requesting their username and a one lime password.
  • the login form will contain a pattern authentication display which will be matrix of numbers that is locally created (i.e. by the browser) using specific user information such as device id and a timestamp that will be encrypted within the matrix.
  • the user will then enter their one time password by recalling from memory their pattern authentication secret and visualising it superimposed onto the pattern authentication display.
  • the one time password will be the sequence of numbers read from the pattern authentication display where their pattern authentication secret resides.
  • the user will become authenticated with the online service when the user returns the session token with their username and one time password (and any additional user information such as device id) to the online service.
  • the encrypted user token for the user previously created by the authentication service and stored on the online service, the session token and the form data (including the one time password) is sent from the online service to the authentication engine.
  • the authentication engine will then decrypt the user token which contains the username, hash-saited password and the pre-defined user code for the user.
  • the authentication engine will then re-create the pattern authentication display sent to the user using the form data used by the browser and attempt to decipher the user's pattern authentication secret. This process is described in more detail below, if the user's pattern authentication secret can be deciphered correciiy the authentication engine will authenticate the user and provide the online service with a session token with the user credentials (usernarne and deciphered user password) to the online service.
  • the online service will then authenticate the user credentials, If the user credentials are correct, authorization is granted and an online service session ID is sent to the user.
  • the user is then associated with the online service and is granted access to restricted content.
  • the system can also be used to authorize user transactions, this is shown in Figure 4 and is described below.
  • the online service will receive a user transaction authorization request from an authenticated and associated user.
  • the online service will authenticate with the authentication engine and request a session token.
  • the online service will send a transaction authorization form to the user, requesting their one time password.
  • the authorization form will contain the required fields for the transaction,
  • a pattern authentication display will be locally created (i.e. by the browser) using specific form data (pre- configured using a plugin module) and external information such as device id and timestamp that will be encrypted within the pattern authentication display,
  • the user will then enter their one time password by recalling from memory their pattern authentication secret and visualising it superimposed on the pattern authentication display.
  • the one time password will be the sequence of numbers read from the pattern authentication display where their pattern authentication secret resides,
  • the user will then return the form data, including the session token with their one time password and any specific form fields for the transaction to the oniine service.
  • the online service will then send the user the session token and the specific form data including tie one time password and a stored encrypted user token that is specific to the user to the authentication engine.
  • the authentication e n g i n e will then decrypt the user token which contains the username, hash-salted password and a pre-defined user code for the user.
  • the authentication engine will also decrypt the session token which contains the device id.
  • the authentication engine wifi then re-create the pattern authentication display presented to the user using the same form data used by the browser and then attempt to decipher the pattern authentication secret.
  • the deciphering of the pattern authentication secret is described in more detail below. If the pattern authentication secret is able to be deciphered, the deciphered user credentials obtained from the pattern authentication secret are sent from the authentication engine to the online service. If the online service authenticates the user credentials, the online service will authorize the transaction.
  • the plugin module is installed, enabled and configured using the registration details from the authentication engine, created for each account of the online service. Once enabled, previous user passwords will no longer work, and a forgotten password process must be executed for each user. If the module is activated and then disabled, existing passwords created using the pattern authentication technology (pattern authentication technology) will no longer work, and a forgotten password process must be executed for each user.
  • the piugin module can provide administrative functions such as: enabling m disabling le pacht autheiiialbn t®chn ⁇
  • the plugin module handles service requests and holds active tokens in a database.
  • the tokens are used to manage the status of the communication with the authentication engine for each user.
  • An online service will complete the following tasks and fulfil the following requirements in order to successfully register with the authentication: 1 )
  • the online service must have a public key certificate installed on its server.
  • the online service will create an account on the authentication engine that will generate and keep a provider key and a provider secret.
  • the online service will authorize an administrative user to use the authentication engine account.
  • the provider key is a unique string of characters that is encrypted using a private key known only to the authorization server.
  • the decrypted provider key contains the name of the account, the type of the account, and the service expiration date/time.
  • Provider secret :
  • the provider secret is a unique string of characters generated using CSPRNG and known only to the authentication engine and the online service. This secret is used to digitally sign ail messages.
  • the token secret is a unique string of characters generated using CSPRNG and known only to the authentication engine. This secret is used to encrypt ail tokens created by the authentication engine. This secret is re-created at specific intervals.
  • the pre-defined user code is encrypted with a user secret that is combined with the associated username and the provider account name, ensuring that every user has a unique secret.
  • the user secret changes at regular intervals. Before each change, the previous user secret is overwritten with a new user secret.
  • a pre-defined user code fails decryption : the previous user secret is used. If this succeeds, the administrator is notified that an old pre-defined user code was used, and the online service must ask for the user token to be re-generated, encrypting the pre-defined user code with the new user secret. If decryption fails again, the administrator is notified that an out- of-date pre-defined user code was used, and the authentication engine disassociates with the online service.
  • the oniine service obtains a session token by asking the authentication engine to start a new session.
  • a session token is a string of characters that enables an online service to request a new service from the authentication engine, A session token is only valid for a single sen/ice request.
  • a session token is encrypted using a token secret and contains the following information:
  • the authentication engine On expiration of a session token, the authentication engine will disassociate with the online service.
  • An online service obtains a user token by asking the authentication engine to create a user token. This request will be accompanied by a pattern authentication secret entered by the user. A valid session token must be provided,
  • a user token is a string of characters that enables an authentication engine to decipher the one time password sent from the online service specifically for a challenge service.
  • the user token is encrypted using the user secret combined with the usemame and account name and contains the following information:
  • the authentication engine On expiration of a user token, the authentication engine will disassociate with the online service,
  • An online service can request renewal of a user token by asking the authentication engine to do so. This request will be accompanied by the user token. A valid session token must be provided. The user token is renewed by decrypting the provided user token using the request secret, then re-encrypted using a new request secret combined with the username and account name. Generatingt the pattern authentication display
  • the pattern authentication display is Socally generated on the user's browser using key data held within the form fields and encrypted as a matrix of numbers that appears randomized.
  • the same encryption mechanism and key data is used by the authentication engine to create the same pattern authentication display in order to decipher the one time password.
  • the size of the pattern authentication display is held in the online service account configuration and specified at the time of registration.
  • the size, c is an even number greater than 4 representing the number of ceils across. In particular:
  • Each cell will contain a number of value between: 0 to (c-1 )
  • a data structure is created that represents the matrix as quads of 4
  • each location in the matrix is Indicated by a number zxy.
  • the form data is taken and used to generate a hash value that is 64 characters long. When c ⁇ 8 only the first 38 characters are used.
  • a base84 decode is performed for each character and then a modulo operation based on the number of values left In the array Is performed. For e TM 8, the result will be a number between 0 and 35, then 34 etc. This is used as an index into the array of unused values. This is removed from the array of value counts to ensure an even distribution.
  • the data structure is then populated with the value and an associated bitmask.
  • the bifmask will be a 10bit encoding of the ceil number:
  • x is converted to a 3 bit binary number.
  • a pattern authentication secret will be represented as a sequence of cell numbers as per the previous table.
  • the pattern authentication secret cell sequence is looped through and concatenated with the bitmasks where the ceils match:
  • the resulting 80bit mask is converted into l Ochars using base64 encoding
  • the pre-defined user code is a security option thai enables quicker deciphering of a one time password by reducing the number of patterns that are needed to be checked, This is done by holding limited information about a user's pattern authentication secret. This allows false patterns to be quickly determined and measures can be taken to lock out potential hackers.
  • a predefined user code identifies a user because if a different pre-defined user code is presented, the deciphering process will always fail to resolve the one time password.
  • the security options of the pre-defined user code can be configured by the administrative user using the plugsn module.
  • the options are:
  • Each pre-defined user code is AES258 encrypted with a unique secret key known only to the authentication engine and is stored by the online service. Therefore, all of the options set out above can be used without any reduction in security. The only reason for changing the options would be for the speciai case where compromise of the online service is seen as a risk, such as no SSL certificate installed, or the online service database is accessible externally. In these cases, it could be possible for hackers to gain access to the data and obtain the user token, then apply decryption techniques to attempt to reveal the data within the token.
  • option 1 is used and the predefined user code holds information on the quads where the pattern authentication secret resides. This is done in the following manner:
  • the quad data structure is used to determine the where the pattern authentication secret resides.
  • a string is created usii empty quads and 1 for popufated quads where the pattern authentication secret resides:
  • the authentication engine loops through the one time password sequence and matches values in the pattern authentication display quad data structure. Any cells that are not in the decoded pre-defined user code are skipped. This is done in the following manner, :

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Storage Device Security (AREA)

Abstract

The present invention provides advantageous methods and systems for registering and authenticating a user of an online service using pattern authentication secrets. The methods and systems are beneficial over similar methods and systems according to the prior art in that they utilize a pre- defined user key in order to improve security and in order to improve the speed by which a user can be authenticated. In particular, the method differs from the prior art in that when a user registers with an online service and generates their pattern authentication secret a pre-defined user key is also generated. Subsequently, when the user wishes to be authenticated that pre- defined user key is utilised to decipher the user's pattern authentication secret.

Description

TITLE
Method and System of Registering and Authenticating a User of an Online Service
Field of invention
The method of the present invention relates to the use of passwords to register and authenticate users of an online service, in particular the present invention provides an improved method of registering and authenticating users using pattern authentication technology whereby the authentication may be significantly faster than prior art methods.
Background
In many situations it is desirable to authenticate the identity of a user of an online service using something more secure than a fixed password or PIN, This is because passwords and PINs can be easily captured by other parties such as hackers or even colleagues with malicious intent, It is already established that one-time passwords are superior to passwords and PINs, as by definition, they are different each time. There are a number of existing systems designed to deliver one time passwords to users, but in the main these tend to depend on either additional hardware being carried by the user (for example "key-fob" tokens) or mobile phones, This dependence on hardware tends to raise the cost of such solutions, while reducing convenience. The present invention is intended to retain the convenience and usability of passwords and PINs, while at the same time introducing the additional security offered by one time passwords. The present invention also reduces the amount of processing required so that the authentication can be carried out within an acceptable time-frame.
An online service may be any web-based service that requires users to securely log-in. For example, internet banking services and online forums are online services according to the present application. The present invention is one of a number of solutions employing pattern authentication technology in the authentication process. This authentication uses a matrix of elements (which may be numbers, letters, pictures etc) and involves the user proving his identity by extracting and then inputting a predetermined sequence of those elements from the matrix in the correct order, in effect creating an one time password from those elements.
More specifically, pattern authentication technoiogy generally comprises the following steps;
Upon registering with an online service a user will be required to define a password in the form of a pattern authentication secret, typically this is a sequence of positions in a matrix. For example, in a 8x8 matrix a pattern authentication secret may comprise a sequence of 8 positions in that matrix, Both the sequence end the specific positions make up the pattern authentication secret. The user will memorise their pattern authentication secret.
The present invention is intended to create an additional layer of security for such online sen/ices. Using the method described, an authentication engine converts the pattern authentication secret into a complex passcode able to be used in an authentication process. It does this by encoding the pattern authentication secret into 10 ASCII characters, which are sent to the online service to be hashed and stored in the conventional way, typically using oneway cryptographic hashing. Thus the only unencrypted record of a user's pattern authentication secret is in the memory of the user. Neither the authentication engine nor the online service store any raw (unencrypted) user data or passwords, and the authentication engine does not store any customer data.
When authentication is required a login form requesting their username will be presented to the user, together with a pattern authentication display, in place of the norma! password field. The pattern authentication display will consist of a matrix of elements containing pseudo-random characters for example, a 8x6 matrix with one of six characters (eg. the numbers 0-5) in each position wherein each character is used 8 times, The pattern authentication display will be locally generated, for exampie by the user's browser, using user specific information such as device ID (eg. ME\ number on a phone), a session token obtained from the authentication engine and a time-stamp that will be encrypted within the matrix.
The user then generates a one time password by inputting the sequence of characters from the pattern authentication display corresponding to their memorised pattern authentication secret, That is, the one time password will be the sequence of characters read from the pattern authentication display where their pattern authentication secret resides. The form containing the one time password, the session token, and any additional user information, such as the device ID, is then sent to the online service.
The online service forwards this form data to the authentication engine which converts the one time password back into a standard password, allowing the online service to authenticate the user, !n other words the authentication engine performs the function of a deciphering engine.
The authentication engine acts as a deciphering engine in the following way:
Using the same user-specific information (eg. device ID, session token, time- stamp), the authentication engine independently re-creates the pattern authentication display, and using the one time password it calculates all the possible combinations that match the pattern authentication secret. This can take a significant amount of time and/or processing power. For example, in the 6x8 matrix set out above, there are 46,856 possible combinations. Checking all of these combinations typically takes up to 10 seconds or more on many systems. The authentication engine cycles through each combination, hashing each potential pattern authentication secret, until it matches the correct password hash obtained from the online sen/ice.
If a match is found while cycling through the possible combinations, the resulting pattern authentication secret is converted back into a password and returned to the online service to authenticate the user in the normal way. The online service will check the user credentials and, if they are correct, will grant authentication to the user.
Despite the excellent security offered by pattern authentication there is one particular issue with the current methods of implementation. In particular, the number of potentially valid pattern authentication secret combinations that must be checked in order to authenticate a user can be excessive. For example, an existing pattern authentication technology presents a user with a 8x6 matrix containing a restricted character set of only 6 characters and the user will have a memorable pattern sequence that is 8 characters iong. Therefore, in order to authenticate a user, the authentication engine will have to check up to 48,858 combinations of pattern authentication secret in order to determine whether the correct one time password was entered. This can be extremely onerous, particularly if a large number of authentication requests from different users are received.
The number of combinations required to be checked can be reduced by reducing the character set of the matrix, or by reducing the length of the pattern authentication secret, or by reducing the size of the matrix. However, ail of these options also reduce the security of the method, it has been desirable to reduce the number of combinations that are required to be checked without reducing any of these variables. One way of doing this was proposed in GB1214200.6 and comprises splitting up the pattern authentication secret into segments and checking each segment against a different hash separately. However, this system is cumbersome and is not considered ideal.
In fight of the above there is a need for an improved method of registering and authenticating a user of an online service using pattern authentication. Summary of Invention
The present invention provides a method of authenticating a user of an online service comprising the steps of:
generating a matrix of elements and sending the matrix to a user;
receiving an input from the user comprising an indication of a subset of the matrix elements in the form of a one-time password corresponding to an ordered set of pre-determined positions within the matrix;
deciphering the order set of pre-determined positions from the input; authenticating the user if the deciphered pre-determined positions match those associated with the user;
characterised in that:
a pre-defined user code is utilised to decipher the pre-determined positions.
Advantageously the method of the present invention operates in substantially the same manner as that set out above in the background to the invention. In particular, the method is designed to be implemented by an online service using an authentication engine. The ordered set of pre-determined positions is the user's pattern authentication secret and the generated matrix of elements is the pattern authentication display. However, it is to be understood that the essential features of the invention are those set out in claim 1 and that the skilled person may be able to implement the method of claim 1 in ways other than that set out in the background section of the present application. Nevertheless for the remainder of the specification the terminology set out in the background section will be used to describe the present invention. The present invention is advantageous over thai method in that it uses a stored pre-defined user code to enable quicker deciphering of a user pattern authentication secret, in particular, a pre-defined user code is e security option that enables quicker deciphering by reducing the number of combinations that are needed to be checked. Different users may have different pre-defined user codes.
Preferably a user code will be generated for each user during the registration process in accordance with a method according to the present invention, as set out below. That is, when a user first signs up to the online service. Advantageously the user code will be generated by an authentication engine and stored in encrypted form by the online service and not stored by the authentication engine. It will then be provided to the authentication engine with the one time password and any other information about the user, such as the device ID when an authentication request is made. The pre-defined user code may form part of a user token that is kept to identify a user during authentication and contains further information about a user. Preferably an encrypted user code will only be able to be decrypted by the authentication engine and not by the online service.
The user code may comprise a generalised location of each of the predetermined positions. For example, the user code may contain information about each of the predetermined positions to indicate within which of a limited set of positions within the matrix that each position is located. The limited set of positions will be less than the total number of positions within the matrix but greater than one. For example, the user code may contain information about which quadrant of the matrix each of the predetermined positions is located in. Alternatively, the user code may contain information about which set of four positions each of the predetermined positions is located in. The user code may contain information indicating that each specific position of the predetermined positions is located in one of four positions. The user code may also comprise information about the order of the pre~de†ermined positions,
A user code of the method of the present invention may comprise a combination of any of the information set out above. Additionally or alternatively a user code may comprise any other information about a user's pattern authentication secret that reduces the number of combinations that are required to be checked by the authentication engine,
As each user will have a different pre-defined user code, the pre-defined user code acts as a further security measure. This is despite the fact that the use of a pre-defined user code reduces the number of combinations that are needed to be checked by the authentication engine, if the wrong pre-defined user code is used when the combinations are checked the authentication engine will check the wrong combinations and will not be able to authenticate the user.
The present invention also provides a system for operating the method of the present invention, The system comprising an online service, an authentication engine and a plugin module.
In practice, the authentication method of the present invention may operate in the following manner.
A previously registered user of the online service will access a website of the online service and be presented with a log in form including a matrix containing a plurality of positions, The user will input their account details, such as user name or email address, and provide an input giving an indication of a subset of the matrix elements corresponding to an ordered set of predetermined positions within the matrix. That input will be a string of matrix elements corresponding to their previously registered ordered set of predetermined positions within the matrix (see below) i.e. the matrix elements corresponding to the user's password or pattern authentication secret. On receiving the above input, the online service will send the input along with user identifying information, a previously generated hashed user password, and a previously generated user code (see below) to an authentication engine. The authentication engine wiil recreate the matrix presented to the user from the information supplied by the oniine service. The authentication engine will then iterate through the possible patterns that could have been entered based on the matrix presented to the user and the user code, hashing each pattern and comparing it with the previously generated hashed user password. If the authentication engine finds a pattern that matches the user password the user is authorised. If a pattern is not found the user is not authorised.
The present invention also provides a method of registering a new user of a secure online service comprising the steps of:
presenting the user with a matrix containing a plurality of positions; receiving and confirming an input from the user comprising an ordered generating a password and a pre-defined user code from the input, wherein:
the password is an encoding of the ordered set of positions; and the pre-defined user code is an encrypted string containing generalized information regarding the ordered set of positions.
In order for the above method of authenticating a user to operate it is necessary for each new user of the oniine service to be registered with the online service and for a password and user code for that user to be generated. Preferably this is done using the method of registering a new user according to the present invention. The method is beneficial as it uses a fairly conventional registration experience for a user to generate an appropriate password and, importantly, a pre-defined user code for the user. The password of the method of registering a new user is the pattern authentication secret of the method of authenticating a user according to the present invention.
The user code of a method of registering a user according to the present invention may have any of the features of the method of authenticating a user according to the present invention, as set out above. In order for a method of registering a user according to the present invention to be used with a method of authenticating a user according to the present invention it is necessary that the user code of both methods has the same features.
Similarly, the matrix of a method of registering a user according to the present invention may have any of the features of the method of authenticating a user according to the present invention, as set out above, in order for a method of registering a user according to the present invention to be used with a method of authenticating a user according to the present invention it is necessary that the matrix of both methods has the same features.
The method of registering a user according to the present invention may further comprise an initial step of providing the user with a one-time link to access the subsequent method steps. That is, a new user may access the method of registering a user using a substantially conventional process whereby they input their details into the online service and are then sent a one-time fink to allow them to access the steps necessary to generate their password (pattern authentication secret) and user code. It is understood that the skilled person will be well acquainted with this process.
Preferably, in order to ensure security, the method of registering a new user according to the present invention is implemented using an authentication engine that is remote to the online service, in particular, it is preferable that the user code is generated by an authentication engine that is remote to the online service and the password (pattern authentication secret) is encoded by the online service. A user code may be generated according to security parameters pre-defined for the online service on the basis of the efficiency required for the method of authenticating a user. A more precise user code i.e. one that contains more information about the user's password (pattern authentication secret), will result in a user being abie to be authenticated more quickly, whilst a less precise user code will result in a user being authenticated more slowly.
Preferably, after generation, a user code is encrypted and then stored by the online service in a secure database. Similarly, it is preferable that after generation the password (pattern authentication secret) of a user is hashed and stored by the online service in a secure database.
The method of registering a user according to the present invention may be operated using any appropriate system. A system for registering a new user of a secure online service, operating the method set out above may comprise: the online service and an authentication engine remote to the online service.
The method of registering a user according to the present invention may operate in the following manner.
When a user wants to register with an online service they will enter a website of the online service and be presented with a new user registration form. That registration form will allow them to input their user details, which may include username, email address and any other relevant personal information. The user will input the necessary details and submit thern to the online service. The user will then be sent a one-time link by email that they must use to access the online service and thereby validate their email address.
On using the one-time link the user will be asked to follow a registration process. In particular, they will be presented with a matrix containing a plurality of positions and they will be asked to enter a pattern by indicating an ordered set of positions within the matrix. For example, this can be done by clicking on the relevant positions in the matrix in order. The user will then be asked to confirm the ordered set of positions within the matrix and that they are happy with their choice, This ordered set of positions then forms the user's password or pattern authentication secret.
The online service will then send the password (pattern authentication secret) to an authentication engine along with user identifying information, such as a device id of the user and the time of creation. The authentication engine will then encode the password (pattern authentications secret), for example this may be a 10 character base64 encoding of the ordered set of positions. The password may then be hashed with a salt, for example using SHA512, and then stored in a secure database by the online service, The authentication engine will also generate a user code for the user. As set out above, the user code will contain generaiised information regarding the user's password although it may also contain other user information. After generation the user code will be encrypted and then stored by the online service in a secure database.
When the user subsequently requires authentication they can be authenticated using the user code and password (pattern authentication secret) stored by the online service using the method of authenticating a user according to the present invention.
Further features and advantages of the present invention will be apparent from the following description of a specific embodiment of the present invention. Unless otherwise indicated above, the features of the specific embodiment are not to be taken to be essential and may be replaced by any alternatives or equivalents that would be apparent to a person skilled in the art or may be entirely absent. Drawings
Figure 1 is a sequence diagram of the online service registration and association process of the specific embodiment of the present invention;
Figure 2 is sequence diagram showing the process of registering or changing a user of the specific embodiment of the present invention;
Figure 3 is a sequence diagram showing the user authentication of the specific embodiment of the present invention; and
Figure 4 is a sequence diagram showing a user transaction authorisation of the specific embodiment of the present invention.
A system according to the present invention operating a specific embodiment of the method of the present description is described below. The system is designed to function under high demand, serving multiple and concurrent connections. The system piatform is a scalable resource that can increase application instances when demand increases. The system is implemented using a queue manager that distributes service requests across the available resource. The queue manager controls the demand using tokens to identify the requests.
The system comprises an online service (the client application), an authentication engine (the resource server) and an authorization server (may be integrated with the resource server). The online service has an SSL public key certificate installed and enabled, end allows secure communication using https. The authentication engine has an SSL public key certificate instai!ed and enabled, and allows secure communication using https. The authorization server has an SSL public key certificate installed and enabled, and allows secure communication using https.
The authentication engine is only available to registered online services. Upon initial use, an online service will register with the authorization server using a service registration process, This is illustrated in Figure 1. The authorization server establishes a provider key and a provider secret. The process and requirements for provisioning these are by use of a plugin module that manages communication with the a u t h o r iza t i o n s e rve r a n d t h e authentication engine via an application programming interface (API), A provider key is used to identify the online service. The provider secret is a shared secret that is used to verify the online service's identity.
When an online service wishes to register to use the authentication engine resource, the online service will become authenticated and associated with the authorization server by using the provider key that is sent from the online service to the authentication engine. The authorization server then sends an access token to the online service which is stored and used to communicate directly with the authentication engine. The access token is vaiid for a fixed period and is routinely renewed.
When a user makes an authentication request to the online service, the online service will become authenticated and associated with the authentication engine by using the access token that is sent from the online service to the authentication engine. The authentication engine then sends a session token to the online service. The session token is only valid throughout a single user authentication process and is used to authorize a request.
The system can be used for new user registration and if an existing user forgets their usemame or password. This is illustrated in Figure 2 and described below.
When a new user is registered a user with administrative privileges will send a user registration request to the online service. The online service will use its standard user registration process to create a new user and send a one-time login link via email to the new user. When the new user receives the email and clicks the one-time login link, a mandatory change pattern authentication secret (PAS) form will be presented.
When a user forgets their username or password the online service will use a standard change password process to change the user's password and send a one-time login link via email to the user. When the user receives the email and ciicks the one-time login link, a mandatory change pattern authentication secret form will be presented.
In either case the online service will then receive a user change/register pattern authentication secret request from the authenticated and associated user (i.e. they have successfully logged in using the one-time login link from their email). The online service will then send a change/register pattern authentication secret form to the user. The user will follow instructions to create their own pattern authentication secret, enter the pattern authentication secret a second time or watch it p layed back and then test their pattern authentication secret by entering a onetime password (one time password) using a test pattern authentication display (pattern authentication display). The user will then submit the form, sending the form data, including the pattern authentication secret, to the online service.
The online service will authenticate with the authentication engine and request a session token. The new pattern authentication secret is sent together with the u s e r registration details from the online service to the authentication engine. The authentication engine will generate a new standard password coded from the pattern authentication secret and send it to the online service. The online service will perform a standard change password process using the password provided by the authentication engine. On success, the online service will send the session token and a new hash-salted password to the authentication engine. The authentication engine will then create a user token for the user, which contains the user code, encrypt the token and send this encrypted user token to the online service to be stored. The process of authenticating and associating a user is shown in Figure 3 and described below.
The online service may receive e user authentication request from a user. The online service will then authenticate with the authentication engine and request a session token. When this is received, the online service will send a login form to the user, requesting their username and a one lime password. The login form will contain a pattern authentication display which will be matrix of numbers that is locally created (i.e. by the browser) using specific user information such as device id and a timestamp that will be encrypted within the matrix.
The user will then enter their one time password by recalling from memory their pattern authentication secret and visualising it superimposed onto the pattern authentication display. The one time password will be the sequence of numbers read from the pattern authentication display where their pattern authentication secret resides.
The user will become authenticated with the online service when the user returns the session token with their username and one time password (and any additional user information such as device id) to the online service. The encrypted user token for the user, previously created by the authentication service and stored on the online service, the session token and the form data (including the one time password) is sent from the online service to the authentication engine.
The authentication engine will then decrypt the user token which contains the username, hash-saited password and the pre-defined user code for the user. The authentication engine will then re-create the pattern authentication display sent to the user using the form data used by the browser and attempt to decipher the user's pattern authentication secret. This process is described in more detail below, if the user's pattern authentication secret can be deciphered correciiy the authentication engine will authenticate the user and provide the online service with a session token with the user credentials (usernarne and deciphered user password) to the online service. The online service will then authenticate the user credentials, If the user credentials are correct, authorization is granted and an online service session ID is sent to the user. The user is then associated with the online service and is granted access to restricted content.
The system can also be used to authorize user transactions, this is shown in Figure 4 and is described below.
The online service will receive a user transaction authorization request from an authenticated and associated user. The online service will authenticate with the authentication engine and request a session token. The online service will send a transaction authorization form to the user, requesting their one time password. The authorization form will contain the required fields for the transaction, A pattern authentication display will be locally created (i.e. by the browser) using specific form data (pre- configured using a plugin module) and external information such as device id and timestamp that will be encrypted within the pattern authentication display,
The user will then enter their one time password by recalling from memory their pattern authentication secret and visualising it superimposed on the pattern authentication display. The one time password will be the sequence of numbers read from the pattern authentication display where their pattern authentication secret resides,
The user will then return the form data, including the session token with their one time password and any specific form fields for the transaction to the oniine service. The online service will then send the user the session token and the specific form data including tie one time password and a stored encrypted user token that is specific to the user to the authentication engine.
The authentication e n g i n e will then decrypt the user token which contains the username, hash-salted password and a pre-defined user code for the user. The authentication engine will also decrypt the session token which contains the device id. The authentication engine wifi then re-create the pattern authentication display presented to the user using the same form data used by the browser and then attempt to decipher the pattern authentication secret. The deciphering of the pattern authentication secret is described in more detail below. If the pattern authentication secret is able to be deciphered, the deciphered user credentials obtained from the pattern authentication secret are sent from the authentication engine to the online service. If the online service authenticates the user credentials, the online service will authorize the transaction.
Specific details of the parts of the processes and system described above |p set out below.
Plugin Module
The plugin module is installed, enabled and configured using the registration details from the authentication engine, created for each account of the online service. Once enabled, previous user passwords will no longer work, and a forgotten password process must be executed for each user. If the module is activated and then disabled, existing passwords created using the pattern authentication technology (pattern authentication technology) will no longer work, and a forgotten password process must be executed for each user.
The piugin module can provide administrative functions such as: enabling m disabling le palern autheiiialbn t®chn<|iogy lyilm; fPl or disabling pattern authentication technology to a group or groups; enabling or disabling pattern authentication technology to a user or set of users. If permission is granted, each individual user may have the facility to enable or disable pattern authentication technology for their account.
Once an online service is registered with the authentication engine, the plugin module handles service requests and holds active tokens in a database. The tokens are used to manage the status of the communication with the authentication engine for each user.
Registering an online service with the authentication engine
An online service will complete the following tasks and fulfil the following requirements in order to successfully register with the authentication: 1 ) The online service must have a public key certificate installed on its server.
2) The online service will install the plugin module on its website content management system (CMS)
3) The online service will create an account on the authentication engine that will generate and keep a provider key and a provider secret.
4) The provider key and provider secret will be copied and pasted into the piugin module on the online service.
5) The online service will authorize an administrative user to use the authentication engine account.
Authorisation Server keys and Secrete
Provider key:
The provider key is a unique string of characters that is encrypted using a private key known only to the authorization server. The decrypted provider key contains the name of the account, the type of the account, and the service expiration date/time. Provider secret:
The provider secret is a unique string of characters generated using CSPRNG and known only to the authentication engine and the online service. This secret is used to digitally sign ail messages.
Token secret:
The token secret is a unique string of characters generated using CSPRNG and known only to the authentication engine. This secret is used to encrypt ail tokens created by the authentication engine. This secret is re-created at specific intervals.
User secret:
The pre-defined user code is encrypted with a user secret that is combined with the associated username and the provider account name, ensuring that every user has a unique secret. The user secret changes at regular intervals. Before each change, the previous user secret is overwritten with a new user secret.
When a pre-defined user code fails decryption: the previous user secret is used. If this succeeds, the administrator is notified that an old pre-defined user code was used, and the online service must ask for the user token to be re-generated, encrypting the pre-defined user code with the new user secret. If decryption fails again, the administrator is notified that an out- of-date pre-defined user code was used, and the authentication engine disassociates with the online service.
Obtaining a„ session token
The oniine service obtains a session token by asking the authentication engine to start a new session. A session token is a string of characters that enables an online service to request a new service from the authentication engine, A session token is only valid for a single sen/ice request.
A session token is encrypted using a token secret and contains the following information:
Token type: request
Version: Vaa,bb; and
Expiration date/time: <YYYY><MM><DD>T<HH><MM><SS>
On expiration of a session token, the authentication engine will disassociate with the online service.
Obtaining a user token
An online service obtains a user token by asking the authentication engine to create a user token. This request will be accompanied by a pattern authentication secret entered by the user. A valid session token must be provided,
A user token is a string of characters that enables an authentication engine to decipher the one time password sent from the online service specifically for a challenge service.
The user token is encrypted using the user secret combined with the usemame and account name and contains the following information:
Token type: User
Version: Vaa.bb
Expiration date/time: <YYYY><yM><DD>T<HH><Mlvl><SS> Data: username (provided by the online service) user's email address
user's password (hashed saited password) user code (coded binary data)
On expiration of a user token, the authentication engine will disassociate with the online service,
Renewing a user token
An online service can request renewal of a user token by asking the authentication engine to do so. This request will be accompanied by the user token. A valid session token must be provided. The user token is renewed by decrypting the provided user token using the request secret, then re-encrypted using a new request secret combined with the username and account name. Generatingt the pattern authentication display
The pattern authentication display is Socally generated on the user's browser using key data held within the form fields and encrypted as a matrix of numbers that appears randomized. The same encryption mechanism and key data is used by the authentication engine to create the same pattern authentication display in order to decipher the one time password. The size of the pattern authentication display is held in the online service account configuration and specified at the time of registration. The size, c, is an even number greater than 4 representing the number of ceils across. In particular:
Number of cells™ c * c
Each cell will contain a number of value between: 0 to (c-1 )
There will be exactly c instances of each number in the matrix.
An array of value counts is created:
Figure imgf000022_0001
}
A data structure is created that represents the matrix as quads of 4
000 001 102 103 204 205
010 Oi l 1 12 1 13 214 215
320 321 422 423 524 525
330 331 432 433 534 535
640 641 742 743 844 845
650 651 752 753 854 855
Figure imgf000023_0001
In the data structure each location in the matrix is Indicated by a number zxy. Where:
quad ~ a quad in which the location is situated
x ~ a position along an x axis
y™ a position a!ong a y axis
The form data is taken and used to generate a hash value that is 64 characters long. When c~8 only the first 38 characters are used.
Then a base84 decode is performed for each character and then a modulo operation based on the number of values left In the array Is performed. For e™8, the result will be a number between 0 and 35, then 34 etc. This is used as an index into the array of unused values. This is removed from the array of value counts to ensure an even distribution. The data structure is then populated with the value and an associated bitmask. The bifmask will be a 10bit encoding of the ceil number:
quad is converted to a 4 bit binary number and shifted 6 bits y is converted to a 3 bit binary number and shifted
x is converted to a 3 bit binary number.
Figure imgf000024_0001
Generating a standard password from the pattern authentication secret A pattern authentication secret will be represented as a sequence of cell numbers as per the previous table. Using the same data structure, the pattern authentication secret cell sequence is looped through and concatenated with the bitmasks where the ceils match:
Figure imgf000024_0002
Figure imgf000025_0001
The resulting 80bit mask is converted into l Ochars using base64 encoding
Generating the pre-defined user code for a user token
The pre-defined user code is a security option thai enables quicker deciphering of a one time password by reducing the number of patterns that are needed to be checked, This is done by holding limited information about a user's pattern authentication secret. This allows false patterns to be quickly determined and measures can be taken to lock out potential hackers. A predefined user code identifies a user because if a different pre-defined user code is presented, the deciphering process will always fail to resolve the one time password.
The security options of the pre-defined user code can be configured by the administrative user using the plugsn module. The options are:
1 ) Hold information on the quads where the pattern authentication secret resides:
Approximately 15,000 combinations will be required to be checked in order to determine an incorrect one time password was entered.
Hold information on the pattern authentication secret order:
Approximately 7,920 combinations will be required to b checked in order to determine an incorrect one tim password was entered. If combined with option 1 , only 12 combinations will be required to be checked,
3) Hold the cells in which the pattern authentication secret resides:
Approximately 120 combinations will be required to be checked in order to determine an incorrect one time password was entered. If combined with option 2, only 1 combination will be required to be checked.
Far comparison if no information is held about the user, all 48,656 will be required to be checked in order to determine if an incorrect one time password was entered. Each pre-defined user code is AES258 encrypted with a unique secret key known only to the authentication engine and is stored by the online service. Therefore, all of the options set out above can be used without any reduction in security. The only reason for changing the options would be for the speciai case where compromise of the online service is seen as a risk, such as no SSL certificate installed, or the online service database is accessible externally. In these cases, it could be possible for hackers to gain access to the data and obtain the user token, then apply decryption techniques to attempt to reveal the data within the token.
In this specific embodiment of the invention option 1 is used and the predefined user code holds information on the quads where the pattern authentication secret resides. This is done in the following manner:
The quad data structure is used to determine the where the pattern authentication secret resides. A string is created usii empty quads and 1 for popufated quads where the pattern authentication secret resides:
Figure imgf000027_0001
Deciphering the one time password
In order to decipher the one time password the authentication engine loops through the one time password sequence and matches values in the pattern authentication display quad data structure. Any cells that are not in the decoded pre-defined user code are skipped. This is done in the following manner, :
// initiate array of sequences hoiding all candidate cells
mask ~ decode(user_code) // determine mask type and extract data:
mask_data - decode(user_code) // extract data
if (mask ( ORDER) {
orderjTiask ™ arraymsSice(mask__data,0,8) //first 6 represent order sequence
arraymspiice(maskjMa.8)
1
if (mask | CELL) {
ceil__mask » array_sHce(mask__data,0,6) // represent cells used in the pattern authentication secret array_spiice(mask__data,8) if (mask | QUAD) {
quad_mask « array_slice(mask ...data, 0) // remaining represent the quads used
}
sequences™ array{);
// loop through each sequence
foreach (one time password as sid ~> sreum) {
// loop through each quadrant in the pattern authentication display foreach (quads as qidx™> quad) {
//skip invalid quads
if (maskfGUAD && [in_array(qidx( quadjnask}) {
continue;
}
// check value of each ceil
foreach (quad as oeli jd ~> cell) {
Figure imgf000029_0001
Figure imgf000030_0001
Figure imgf000031_0001
Now loop through the remaining candidates, concatenate masks to get candidate password and hash with salt,
Generate the standard password for the pattern .authentication secret (see
// compare each candidate hash with real hash,
// mtum candidate password if correct AES 256 encryptioin and decryption
Figure imgf000031_0002

Claims

Claims
1. A method of authenticating a user of an online service comprising the steps of:
generating a matrix of elements and sending the matrix to a user;
receiving an input from the user comprising an indication of a subset of the matrix elements that correspond to an ordered set of pre-determined positions within the matrix;
deciphering the pre-determined positions from the input;
authenticating the user if the deciphered pre-determined positions match those associated with the user;
characterised in that:
a pre-defined user code is utilised to decipher the pre-determined positions,
2. A method according to claim 1 , wherein the pre-defined user code comprises a generalised location of each of the predetermined positions.
3. A method according to c!aim 2, wherein the matrix is comprised of a plurality of quads of four positions and the pre-defined user code comprises the quad in which each of the predetermined positions is located.
4. A method according to claim 1 , wherein the pre-defined user code comprises the order of the pre-determined positions.
5. A method according to claim 1 , wherein the pre-defined user code comprises the location of each of the pre-determined positions.
8. A method according to any preceding claim, wherein the matrix has (c x c) cells where c is a number greater than 4.
7, A method according to claim 8, wherein each celi contains an integer of value from 0 to (c-1).
8. A method according to claim 8, wherein there are exactly c instances of each integer within the matrix.
9. A system for authenticating a user of an online service, the system operating a method according to any preceding claim and comprising:
an online service;
a plugin module; and
an authentication engine.
10. A method of registering a new user of a secure online service comprising the steps of;
presenting the user with a matrix containing a piuraiity of positions; receiving and confirming an input from the user comprising an ordered set of positions within the matrix; and
generating a password and a pre-defined user code from the input, wherein:
the password is an encoding of the ordered set of positions; and the pre-defined user code is an encrypted string containing generalized information regarding the ordered set of positions.
1 1 . A method according to claim 10, wherein the pre-defined user code comprises a generalised location of each of the positions.
12. A method according to claim 1 1 , wherein the matrix is comprised of a piuraiity of quads of four positions and the pre-defined user code comprises the quad in which each of the positions is iocated.
13. A method according to claim 10, wherein the pre-defined user code comprises the order of the predetermined positions.
14. A method according to claim 10, wherein the pre-defined user code comprises the location of each of the pre-defermined positions.
15. A method according to any of claims 10 to 14, wherein the matrix has (o x c) cells where c is an even number greater than 4,
16. A method according to any of claims 10 to 15, wherein the method further comprises the initial step of providing the user with a one-time link to access the subsequent method steps.
17. A method according to any of claims 10 to 16, wherein the user code is generated by an authentication engine that is remote to the online sen/ice.
13. A method according to any of claims 10 to 17, wherein the password is encoded by an authentication engine that is remote to the online service.
19. A method according to any of claims 10 to 18, wherein the user code is encrypted and then stored by the online service.
20. A method according to any of claims 10 to 19, wherein the password is hashed with a salt and then stored by the online service.
21 , A system for registering a new user of a secure online service, the system operating a method according to any of claims 10 to 20 and
comprising;
an online service; and
an authentication engine.
PCT/GB2015/053365 2014-11-06 2015-11-06 Method and system of registering and authenticating a user of an online service Ceased WO2016071702A1 (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
GB1419749.5A GB2532204B (en) 2014-11-06 2014-11-06 Method and system of registering and authenticating a user of an online service
GB1419749.5 2014-11-06

Publications (1)

Publication Number Publication Date
WO2016071702A1 true WO2016071702A1 (en) 2016-05-12

Family

ID=52118069

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/GB2015/053365 Ceased WO2016071702A1 (en) 2014-11-06 2015-11-06 Method and system of registering and authenticating a user of an online service

Country Status (2)

Country Link
GB (1) GB2532204B (en)
WO (1) WO2016071702A1 (en)

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2504746A (en) * 2012-08-08 2014-02-12 Steven Jonathan Brittan Matrix Pattern Authentication (MPA) using a divided authentication code

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP3781874B2 (en) * 1997-09-05 2006-05-31 富士通株式会社 Electronic information management apparatus by image instruction, secret key management apparatus and method, and recording medium on which secret key management program is recorded
JP5602054B2 (en) * 2011-02-21 2014-10-08 株式会社シー・エス・イー Offline two-factor user authentication system, method and program

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2504746A (en) * 2012-08-08 2014-02-12 Steven Jonathan Brittan Matrix Pattern Authentication (MPA) using a divided authentication code

Also Published As

Publication number Publication date
GB201419749D0 (en) 2014-12-24
GB2532204B (en) 2017-03-22
GB2532204A (en) 2016-05-18

Similar Documents

Publication Publication Date Title
US11126670B2 (en) Token and device location-based automatic client device authentication
US11544365B2 (en) Authentication system using a visual representation of an authentication challenge
US8365262B2 (en) Method for automatically generating and filling in login information and system for the same
US8862889B2 (en) Protocol for controlling access to encryption keys
US8789150B2 (en) System and method for user authentication
WO2020155779A1 (en) Method and apparatus for authenticating digital signature, computer device and storage medium
US20160205098A1 (en) Identity verifying method, apparatus and system, and related devices
CN112425114A (en) Password manager protected by public-private key pair
EP2339777A2 (en) Method of authenticating a user to use a system
WO2015133990A1 (en) Methods and apparatus for migrating keys
NO324315B1 (en) Method and system for secure user authentication at personal data terminal
CN107920052B (en) Encryption method and intelligent device
EP3556070B1 (en) Use of personal device for convenient and secure authentication
WO2014141263A1 (en) Asymmetric otp authentication system
US11412068B2 (en) User and user device authentication
Wang et al. Amnesia: A bilateral generative password manager
GB2488310A (en) A method and system for authenticating a computer user by using an array of elements
CN115834077A (en) Control method, control system, electronic device, and storage medium
CN108881153B (en) Authentication method used to log in
CN104881595B (en) The self-help remote unlocking method managed based on PIN code
WO2016071702A1 (en) Method and system of registering and authenticating a user of an online service
JP6165044B2 (en) User authentication apparatus, system, method and program
CN103347021A (en) Multi-server safety certification method based on passwords capable of being memorized by people
Ghiasvand One-Time Passwords via SMS
Corella et al. A comprehensive approach to cryptographic and biometric authentication from a mobile perspective

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15797376

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15797376

Country of ref document: EP

Kind code of ref document: A1