Emc Corporation

Paul Dennis

Yedidya Dotan

Lawrence N Friedman

Piers Bowness

John Watts

Lakshmi Suresh

Authentication employs a classification that monitors content of authentication requests and results and assigns and records risk values identifying low-risk sources making normal authentication requests and high-risk sources making abnormal authentication requests indicative of fraud activity. Then for low-risk sources, a normal authentication process is employed having differential success/fail behavior exposing information about an enumerable system resource, such as a user account. Example differential behavior includes (a) granting access when a request identifies a valid user account, and (b) otherwise denying access, enabling an attacker to learn whether a guessed value identifies an existing account. For high-risk sources, a false authentication process is employed having non-differential success/fail response behavior that does not expose the information, such as consistent presentation of a service denial message irrespective of whether the request identifies a valid existing user account, preventing an enumeration attack.

User authentication avoiding exposure of information about enumerable system resources

One embodiment is directed to a method performed by a computing device. The method includes (a) engaging in a handshake procedure with a remote second computing device to establish a secure channel, (b) generating a first encryption key using a first token having a secret seed, the first encryption key being the same as a second encryption key generated by the second computing device using a second token having the same secret seed, and (c) using the first encryption key to engage in encrypted communications with the second computing device. Other embodiments are directed to a computerized apparatus and a computer program product for performing a method similar to that described above.

Token-based key generation

A technique supports authentication of a server device (e.g., a web site). The technique involves supplying a user device (e.g., a client browser) with a user mechanism (e.g., a browser plug-in) which is constructed and arranged to dynamically generate user representations. The technique further involves receiving, at the server device, a request from the user device. The technique further involves providing a server representation to the user device from the server device in response to the request. The user device successfully authenticates the server device when a user representation dynamically generated by the user mechanism matches the server representation provided to the user device. However, the user device unsuccessfully authenticates the server device when the user representation dynamically generated by the user mechanism does not match the server representation provided to the user device.

Growing community of inventors

Wayland, MA, United States of America

Paul Dennis