Emc Corporation

Emc IP Holding Company LLC

Rsa Security Inc.

Massachusetts Institute of Technology

Rsa Data Security, Inc.

Other

Pitney Bowes Inc.

Delco Electronics Corporation

Ronald L Rivest

Ari Juels

Nikolaos Triandopoulos

Kevin Bowers

Marten Van Dijk

John Gordon Brainard

Alina Oprea

Burton S Kaliski, Jr

Adi Shamir

Magnus Nyström

Guoying Luo

Michael Szydlo

Silvio Micali

William Duane

Daniel Vernon Bailey

Karl Ackerman

Dmitri Pal

Samir Dilipkumar Saklikar

Zhou Li

Andrew Nanopoulos

Piers Bowness

Russell Wilbur Pogue, Jr

Yiqun Lisa Yin

Emil P Stefanov

James Alan Kelley

Todd S Leetham

Shane D Rice

Leonard M Adleman

Sumayah Alrwais

Vihang P Dudhalkar

Markus Jakobsson

Burt Kaliski

Matthew John Barton Robshaw

Raymond Mark Sidney

Static and dynamic embodiments are presented for generating chaff passwords for use in a password-hardening system. Chaff passwords are generated by modifying portions of base passwords based on a distribution with which particular strings of digits and symbols appear in user passwords. Location oblivious chaff passwords are generated from a chaff set of passwords obtained from a chaff generation method by applying a random permutation over the elements of the obtained chaff set of passwords.

Chaff password generation based on distribution-based modifications of base passwords

Methods and apparatus are provided for private set membership using aggregation for reduced communications. A determination is made as to whether at least one data element of a client is in a data set of a server by: obtaining a transformation of the at least one data element; receiving a response from the server based on the transformation of the at least one data element, wherein the transformation comprises one or more of a Bloom filter-based transformation that employs a Bloom filter comprising a plurality of hash functions and an encryption-based transformation; and determining whether the at least one data element is in the data set based on the response, wherein one or more of the response and the determining is based on a result of at least one aggregation of a plurality of values that depend on the at least one data element and one or more items in the data set.

Methods and apparatus for private set membership using aggregation for reduced communications

Static and dynamic embodiments are presented for generating chaff passwords for use in a password-hardening system. Chaff passwords are generated by obtaining a source set of passwords comprising at least one valid password for each of a plurality of users; and generating a chaff set of passwords for a given user, wherein the chaff set comprises at least one valid password for the given user and a plurality of chaff passwords for the given user, wherein the plurality of chaff passwords for the given user are obtained from the source set of passwords. Chaff passwords can also be generated by modifying portions of base passwords based on a distribution with which particular strings of digits and symbols appear in user passwords. Location oblivious chaff passwords are generated from a chaff set of passwords obtained from a chaff generation method by applying a random permutation over the elements of the obtained chaff set of passwords.

Methods and apparatus for generating chaff passwords for use in a password-hardening system

Methods and apparatus are provided for password-based secret sharing. An exemplary method comprises obtaining a secret; obtaining a fixed value from at least one party; setting at least one polynomial coefficient of a polynomial employed by a polynomial-based secret sharing scheme to a value that depends on the fixed value and the secret; and applying the polynomial-based secret sharing scheme to the secret to obtain a plurality of secret shares, wherein the plurality of secret shares comprises at least one fixed share derived from the at least one polynomial coefficient. Another exemplary secret sharing method comprises selecting at least one fixed share of a plurality of shares employed by an additive secret sharing scheme that splits the secret into the plurality of shares needed for reconstruction of the secret, wherein the at least one fixed share depends on the fixed value; and setting at least one masked version of the secret employed by the additive secret sharing scheme, wherein the at least one masked version of the secret depends on the at least one fixed share.

Methods and apparatus for password-based secret sharing schemes

Wireless wearable authenticators (WWAs) are provided using attachment to confirm user possession of the WWA. A user is authenticated by receiving authentication information from a wireless, wearable authentication (WWA) device of the user. The authentication information indicates whether the user has substantially continuously worn the WWA since a prior session where the user proved his or her identity to a relying device while wearing the WWA. The user is authenticated based on an evaluation of the authentication information. The authentication information comprises, for example, a credential &#x3ba; and a current session label J. A value of the current session label J can provide the indication of whether the user has substantially continuously worn the WWA since a prior session where the user proved his or her identity to a relying device while wearing the WWA.

Wireless wearable authenticators using attachment to confirm user possession

Methods and apparatus are provided for improving resilience to forward clock attacks. A token generates a passcode from a user authentication token for presentation to an authentication server by detecting a forward clock attack; and communicating an indication of the forward clock attack to the authentication server. The generation of the user authentication passcodes is optionally suspended upon detecting the forward clock attack. The detection may be based on a comparison of a current device time of the token and a last used device time during a generation of a user authentication passcode.

Time synchronization solutions for forward-secure one-time authentication tokens

There are disclosed techniques for use in detecting malicious websites. In at least one embodiment, there is disclosed a technique for generating a profile in connection with a website. The profile comprising at least one attribute associated with the website. The technique also comprises collecting information relating to the website during a visit to the website. The technique further comprises detecting a change in connection with the website. The detection of the change comprises identifying a variation between the generated profile and the collected information.

Detecting malicious websites

A method comprises storing in a memory of a first processing device information relating to one or more historical events visible to the first processing device and a second processing device. The method further comprises, in an authentication sessions between the first processing device and the second processing device, transmitting an indicator derived from at least a portion of the stored information from the first processing device to the second processing device. The indicator permits the second processing device to determine authenticity of the first processing device.

Determining authenticity based on indicators derived from information relating to historical events

Methods and apparatus are provided for silent alarm channels using one-time passcode authentication tokens. A message is transmitted indicating a potential attack on a protected resource by obtaining the message; combining the message with a tokencode generated by a security token to generate a one-time passcode; and transmitting the one-time passcode to a receiver. A plurality of the messages can be obtained in parallel, and the plurality of parallel messages can be combined with the tokencode to generate the one-time passcode. A subsequent message can optionally be generated by applying a hash function to a prior n-bit value to provide a counter identifying each message. The message optionally also comprises one or more additional bits to provide an annotation of the message.

Methods and apparatus for silent alarm channels using one-time passcode authentication tokens

A processing device is configured to identify a plurality of defensive security actions to be taken to address a persistent security threat to a system comprising information technology infrastructure, and to determine a schedule for performance of the defensive security actions based at least in part on a selected distribution derived from a game-theoretic model, such as a delayed exponential distribution or other type of modified exponential distribution. The system subject to the persistent security threat is configured to perform the defensive security actions in accordance with the schedule in order to deter the persistent security threat. The distribution may be selected so as to optimize defender benefit in the context of the game-theoretic model, where the game-theoretic model may comprise a stealthy takeover game in which attacker and defender entities can take actions at any time but cannot determine current game state without taking an action.

Scheduling of defensive security actions in information processing systems

Multi-server one-time passcode verification is provided for respective high order and low order passcode portions. A user is authenticated by receiving an authentication passcode generated by a token associated with the user; and authenticating the user based on the received authentication passcode using at least a first authentication server and a second authentication server, wherein the first authentication server verifies a high-order portion of the received authentication passcode and wherein the second authentication server verifies a low-order portion of the received authentication passcode. The received authentication passcode is based on, for example, at least two protocodes Pand Pgenerated by the token and/or pseudorandom information R. A codebook C, based on the pseudorandom information R, can be used to embed additional auxiliary information into the authentication passcode.

Multi-server one-time passcode verification on respective high order and low order passcode portions

A processing device comprises a processor coupled to a memory and is configured to implement an overlay effects selection interface for use in conjunction with generation of a graphical password. An image is obtained and presented in the overlay effects selection interface with a plurality of user-selectable overlay effects. User input is received identifying at least one overlay effect selected from the plurality of user-selectable overlay effects, and a modified version of the image is presented incorporating the selected at least one overlay effect. Information characterizing the image and the selected at least one overlay effect is utilized to control access to a protected resource. For example, the information characterizing the image and the selected at least one overlay effect may be obtained as part of a graphical password enrollment process and stored as at least a portion of the graphical password for controlling access to the protected resource.

Authentication based on user-selected image overlay effects

Server methods and apparatus are provided for processing passcodes generated by configurable one-time authentication tokens. An authentication server is configured to process an original passcode generated by a configurable one-time authentication token by configuring the authentication server to have a server configuration that is compatible with a selected configuration of the configurable one-time authentication token; receiving a candidate passcode based on the original passcode generated by the configurable one-time authentication token; and processing the Is candidate passcode based on the server configuration. The selected configuration of the configurable one-time authentication token must always enable a forward-secure pseudorandom number generation feature for the one-time authentication token and at least one additional selected token feature.

Server methods and apparatus for processing passcodes generated by configurable one-time authentication tokens

Techniques for providing authentication functionality in a gaming system are disclosed. In one aspect, a gaming system is configured such that, at a given point during a current session of a game in progress that involves at least one user previously granted access by the system to participate in the current session, information available from an authentication token associated with the user is obtained prior to allowing the user to take a particular action in the game. A determination is made as to whether or not the user will be allowed to take the particular action in the game, based on the obtained information. The obtained information may comprise, for example, at least a portion of a one-time password generated by a hardware or software authentication token.

Gaming systems with authentication token support

Configurable one-time authentication tokens are provided with improved resilience to attacks. A one-time authentication token is configured by providing a plurality of token features that may be selectively incorporated into the configurable one-time authentication token, wherein the plurality of token features comprise at least two of the features; obtaining a selection of at least a plurality of the token features: and configuring the one-time authentication token based on the selected token features, wherein the configuration must always enable forward security for the one-time authentication token and at least one additional selected token feature. A configurable one-time authentication token is provided that comprises a plurality of selectable token features that may be selectively incorporated into the configurable one-time authentication token, wherein the configurable one-time authentication token is always configured with the forward security and at least one additional token feature.

Growing community of inventors

Arlington, MA, United States of America

Ronald L Rivest