Emc Corporation

Emc IP Holding Company LLC

Other

Michael J O'Malley

John Gordon Brainard

Robert S Philpott

William Duane

Daniel Vernon Bailey

Nikolaos Triandopoulos

Kevin Bowers

Marten Van Dijk

Samuel Curry

Sean Patrick Doyle

Daniel Bailey Vernon

Ari Juels

Riaz Zolfonoon

Andrew Nanopoulos

Christopher W Duane

Yong Qiao

Millie Ng

Andrea Doherty

Karl G Kowalski

Robert S Phipott

Gideon Ansell

Aaron Kechley

Robert T Frohman

A technique provides a secret to authenticate a user. The technique involves storing, by processing circuitry, an initial secret in local memory. The technique further involves receiving, by the processing circuitry, a release command after the initial secret is stored in the local memory. The technique further involves, in response to the release command and based on the initial secret, outputting a released secret through an audio jack which is coupled to the processing circuitry. With such a technique, the secret is only exposed in response to user actuation thus providing improved security against an attacker vis-&#xe0;-vis a conventional authentication token which constantly generates and outputs a series of one-time use passcodes (OTPs) on a display based on a seed stored in memory.

User actuated release of a secret through an audio jack to authenticate the user

There is disclosed herein techniques for use in skill-based authentication. The techniques comprise determining a skill associated with a user. Also, the techniques comprise providing a user challenge based on the skill. Further, the techniques comprise receiving a user response to the user challenge. Additionally, the techniques comprise determining whether to authenticate the user based on the user response.

Skill-based authentication

A technique transfers soft token authentication capabilities from an old device to a new device. The technique involves receiving a transfer initiation message from the old device while the old device is currently provisioned with the soft token authentication capabilities. The transfer initiation message includes new device binding information obtained by the old device from the new device. The technique further involves providing a reply message to the old device in response to the transfer initiation message. The reply message directs the old device to supply an authentication code to the new device, the authentication code being based on the new device binding information. The technique further involves receiving, from the new device, a provisioning message including the authentication code, and provisioning the new device with the soft token authentication capabilities in response to receipt of the provisioning message from the new device.

Transferring soft token authentication capabilities to a new device

A method, system, and apparatus for agile generation of one time passcodes (OTPs) in a security environment, the security environment having a token generator comprising a token generator algorithm and a validator, the method comprising generating a OTP at the token generator according to a variance technique; wherein the variance technique is selected from a set of variance techniques, receiving the OTP at a validator, determining, at the validator, the variance technique used by the token generator to generate the OTP, and determining whether to validate the OTP based on the OTP and variance technique.

Agile OTP generation

There is disclosed a technique for use in authentication. In one embodiment, the technique comprises a method with the following steps. The method comprises detecting an occurrence associated with an authentication device. The method also comprises receiving a one-time password as issued by the authentication device. The method further comprises receiving an authentication factor, wherein the authentication factor is unrelated to one-time passwords issued by the authentication device. The method still further comprises determining whether to suspend authentication by the authentication device based on the one-time password and the authentication factor.

Method, apparatus, and computer program product for determining whether to suspend authentication by an authentication device

A technique controls a soft token running within an electronic apparatus. The technique involves providing an initial series of authentication codes based on a first set of machine states. The initial series of authentication codes is provided from the electronic apparatus to a server through a forward channel to authenticate a user. The technique further involves receiving a command from the server through a reverse channel between the electronic apparatus and the server. The reverse channel provides communications in a direction opposite to that of the forward channel. The technique further involves changing the first set of machine states to a second set of machine states in response to the command, and providing a new series of authentication codes based on the second set of machine states. The new series of authentication codes is provided from the electronic apparatus to the server through the forward channel for user authentication.

Controlling a soft token running within an electronic apparatus

An improved technique for assessing the security status of a device on which a soft token is run collects device posture information from the device running the soft token and initiates transmission of the device posture information to a server to be used in assessing whether the device has been subjected to malicious activity. The device posture information may relate to the software status, hardware status, and/or environmental context of the device. In some examples, the device posture information is transmitted to the server directly. In other examples, the device posture information is transmitted to the server via auxiliary bits embedded in passcodes displayed to the user, which the user may read and transfer to the server as part of authentication requests. The server may apply the device posture information in a number of areas, including, for example, authentication management, risk assessment, and/or security analytics.

Soft token posture assessment

A method is used in ordering inputs for order dependent processing. Ordered inputs are derived from original inputs. The ordered inputs have an order based on values of the original inputs. Order dependent processing logic is applied to the ordered inputs, to produce a result that is derived from the original inputs.

Ordering inputs for order dependent processing

A method, system, and computer product for use in generating one time passcodes (OTPs) in security environment, the security environment comprising an OTP generator and an OTP validator, the method comprising generating, at the OTP generator, an OTP according to a function, wherein the function includes as an input a device id, validating the OTP at the OTP validator, whereby the validation comprises generating, at the OTP validator, a second OTP according to the function, and determining whether the OTP is valid based on a comparison of the OTP with the second OTP generated at the OTP validator.

Device bound OTP generation

A transaction system combats malware and phishing-based MitM attacks on transaction processing systems by using digital signatures to integrity-protect the user-verified transaction data. With this system, a user submits a transaction from a client device (e.g., desktop web browser) over a communications channel to a server device, such as a transaction server. Before accepting the transaction, the transaction server securely delivers all relevant transaction data to a second device (e.g., the signing device), such as a smart phone, in the possession of the user. The signing device has its own distinct communication channel with the server device. The user verifies the data and the signing device creates a digital signature value for the transaction. The user submits the signature to the transaction server to confirm the transaction with the transaction server.

Multi-channel transaction signing

A method of submitting information as part of an authentication operation includes generating a one time password that is intended for use in an authentication operation. The method further includes providing the one time password in a display field, wherein the display field is adapted to work in conjunction with a browser to submit the one time password in response to a request for the one time password. A method of controlling submission of identity information within an authentication system includes receiving a trust list from the authentication system. The trust list identifies entities that are authorized to receive the identity information. The method further includes receiving a request to submit the identity information to a candidate entity for an authentication operation, and providing the identity information to the candidate entity if the trust list indicates that the candidate entity is authorized to receive the identity information.

Growing community of inventors

Lowell, MA, United States of America

Michael J O'Malley