Patent Application
20060206919
The present invention relates generally to ensuring secure access to a computerized device and more particularly to a system and method for secure authentication of a user of a computerized device.
User authentication is one of the most vexing problems in the use of computerized devices. While computers have automated or even enabled many tasks, the use of computers and in particular the access of computerized services over networks has significantly increased risks. While security of personal and corporate data have been secured by the adoption of many security protocols and devices, e.g., encryption, secure protocols, and use of smart cards, these security mechanisms have seen attack in many different forms.
The use of user identification in conjunction with passwords or personal identification numbers (PIN) is one mechanism for protecting access to personal or private corporate data or services that require some form of authentication. Traditionally, the PIN is entered by a user in some type of text box and the PIN is transmitted to an authentication server.
However, passwords and PINs can be attacked and compromised even if these are transmitted over a secure channel in an encrypted form. For example, if an untrusted computer is used to enter an authorization phrase, software executing on that computer may be used to capture that PIN before the PIN has been passed to the encryption layer. Such software can be in the form of software that impersonates the service to which a user may seek access or in the form of keyboard loggers that capture keystrokes entered by users.
PINs and passwords can also be obtained by persons who simply look over the shoulder of a user entering such authorization phrases.
From the foregoing it will be apparent that there is still a need for an improved method to provide user authentication so as to enable secure authentication that is not prone to snooping, shoulder surfing, keyboard logging, or other schemes designed to usurp authentication phrases such as personal identification numbers (PIN) or passwords.
In a preferred embodiment the invention provides a system and method allowing a user to securely log in to a server using an insecure system without imposing the risks of having the user's PIN, password or authorization phrase exposed to sniffing attacks, keyboard logging, shoulder surfing, or similar methods of attack. Such a system and method for secure login requires little overhead in terms of computational resources and storage, can readily be added to existing systems, requires no modification to host computers, and provides users with a hitherto unachieved level of security in logging in using insecure computers.
In response to a request to access a server computing device the server computing device is operated to generate a key representation image having thereon a plurality of individual key images placed at random positions, each corresponding to a possible character value in an authentication phrase. These key representations are transmitted by the server device to the host device using a network protocol. At the host device, the key representations are displayed using a standard web browser on which a user may click on these representations using standard mouse clicks. These mouse clicks are captured and transmitted as a sequence of location values from the host computer to the server computer. After receiving the sequence of location values from the host device transmitted using a network protocol, where the sequence of location values correspond to locations of mouse clicks representing user selections of character values in an attempted authentication phrase; the server device is operated to verify that the sequence of location values corresponds to a correct authentication phrase by mapping the locations of the mouse clicks to the locations of the randomly placed key images.
In another aspect of the invention, a user is authenticated for use of a server computing device wherein the server computing device is connected to a host device by a method including generating a random matrix and receiving from the host device a sequence of values corresponding an attempted authentication phrase wherein the sequence of values correspond to mouse clicks on digits in the random matrix. The attempted authentication phrase is then verified against an authorized authentication phrase wherein the authorized authentication phrase is a function of an authorized user's personal identification number (PIN), a transformation personal identification number (tPIN), and the random matrix.
Other aspects and advantages of the present invention will become apparent from the following detailed description, taken in conjunction with the accompanying drawings, illustrating by way of example the principles of the invention.
In the following detailed description, reference is made to the accompanying drawings that show, by way of illustration, specific embodiments in which the invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention. It is to be understood that the various embodiments of the invention, although different, are not necessarily mutually exclusive. For example, a particular feature, structure, or characteristic described herein in connection with one embodiment may be implemented within other embodiments without departing from the spirit and scope of the invention. In addition, it is to be understood that the location or arrangement of individual elements within each disclosed embodiment may be modified without departing from the spirit and scope of the invention. The following detailed description is, therefore, not to be taken in a limiting sense, and the scope of the present invention is defined only by the appended claims, appropriately interpreted, along with the full range of equivalents to which the claims are entitled. In the drawings, like numerals refer to the same or similar functionality throughout the several views.
Introduction
As shown in the drawings for purposes of illustration, the invention is embodied in a novel system and method for providing secure login on insecure systems. A system and method according to the invention provides a method in which a user may securely enter an authorization phrase, such as a PIN or a password, without the fear that the authorization phrase is being compromised in some manner. Existing methods for entry of authorization phrases are prone to various forms of attack or carry with them inherent limitations such as requiring users to possess tokens for generating one-time passwords (OTP) that require synchronization with a server.
In one aspect, a system and method according to the invention provide a mechanism by which a user may enter an authorization phrase on a randomized key pad in the form of an image displayed to user on a host computer. The host computer has no knowledge of the structure of the image. The user enters the authorization phrase by entering mouse clicks on the randomized key pad image and these mouse clicks are translated into a sequence communicated to a server device which may determine whether the clicks correspond to a correct authorization phrase. The image is difficult to programmatically parse to determine the structure. It is randomized for each use of the authorization phase. It may be further transformed by image manipulations. The host computing device does not need to be trusted. Furthermore, snooping the entered mouse clicks or the sequence that corresponds to the entered mouse clicks would not compromise the underlying authorization phrase. Thus, the present invention provides a higher level of security than previous mechanisms for entering authorization phrases.
The scenario of
The scenario of
In this example, several application programs 301 are executed by the CPU 203 under the control of instructions of a system software 305. The system software 303 may, for example, be a Javacard Virtual Machine as found on the Cyberflex smart card family from Axalto Inc. or the interpreter of a smart card implementing a .NET CLI (Common Language Infrastructure) as found in the NET smart card technology from Axalto Inc. (www.axalto.com/infosec/NET_faq.asp). In alternative embodiments, the application programs 301 are compiled into executable code and do not require further interpretation by the interpreter 305. However, in such embodiments, the job control would be managed by some operating system program that would take the place of the interpreter 303. The application programs 301 may access functions provided by the smart card system software 307 by issuing calls through an application program interface 309.
Secure Login Methodology
As described herein above, a problem that arises when a user uses one computer, e.g., host PC 105, to enter an authorization phrase to gain access to another computer, e.g., the smart card 101 or a remote computer 101′, is that the authorization phrase may be compromised in some manner. The present invention provides a methodology whereby users can be authenticated to a local or remote system by entering an authorization phrase, e.g., a PIN or a password. Any mal-ware that may be installed on the host PC 105 cannot capture the PIN or password as the user enters it. The methodology is based on two sets of approaches. One approach uses random digital scrambling of images, which are then selected by user when entering the PIN. The second approach uses a simple mathematical transformation that is based on a predefined formula. This transformation can generate a virtual PIN that can be used as an OTP without requiring a separate hardware token. Both sets of approaches can be particularly useful when logging in through insecure systems that have mal-ware installed. The following sections describe each of these approaches.
The server side of the methodology of the invention may be implemented as an application program 301 as illustrated in
Virtual Keypad
In one aspect of the invention a user is presented with a virtual keypad.
The virtual keypad drastically reduces the likelihood that a PIN or password can be captured by malicious software as it is typed into a computer. The conventional mode of entering a password requires the use of a keyboard. Keystroke loggers can capture each keystroke, and thereby breech the password. With a virtual keypad approach the easily monitored keystrokes are replaced with hard to attack anonymous mouse clicks. The method is based on digitally scrambling the images that represent a keypad and randomly arranging them on the user screen. The user then clicks on the each image that represents the corresponding number or character in the password. For example, if a PIN is ‘1462’ the user will click on the key images of digits ‘1’, ‘4’, ‘6’, and ‘2’ in that order. No visual indication is provided on the screen that a particular image on the virtual keypad is clicked. Therefore, shoulder surfers cannot guess the password by following the mouse movement from a distance.
In a preferred embodiment, a standard web browser is used to display a virtual keypad for entering the user PIN on a display device connected to a host computer 105. A secure web server, e.g., one of the application programs 301, acts as an authentication server and generates the web pages for providing the secure login mechanism. The web server can be on an enterprise workstation of a service provider, e.g., on a remote computer 101′, or on a network smart card 101.
Step 501: Since a keypad for entering a numeric PIN consists of 10 keys (0 to 9) there is a corresponding number of image files 511a-j, one for each number, stored on the server, e.g., in the non-volatile memory 209. Each of these files contains an image of the digit it represents.
Step 503: In one embodiment of the invention, the images stored in these image files 511a-j are transformed using some random parameters. The transformation process may consist of one or more of the transformations selected from:
The idea behind these transformations is to spoof any digital pattern recognition efforts by malicious software, while still preserving the visual recognition of image by human users. Next, the transformed image is written to a temporary area of NVM under a new name. For example, image 511a is transformed and saved as 511a′.
Step 505: The transformed images are placed on an HTML page 513 in a keypad layout. However, the order of images is randomly scrambled, as illustrated in
Table 1 shows the location of each image either as a sequential position from the first image, or as a coordinate. A RAM buffer is used to temporarily store this mapping of each image to its current rendered location.
Two alternative ways of placing the image files on the HTML page 513 include composing one image file from each of the individual image files and, alternatively, to have the HTML page 513 refer to each individual image file. In the second alternative an additional transformation is possible, namely, to randomize the file names of the individual image files, thereby making any inference from the file name impossible. Similarly, the image file containing a composite representation may also have a randomized file name to obscure that it contains a representation of keys used to enter an authorization phrase.
Step 507: A scripting code, e.g. in JavaScript, is added to the HTML page 513 producing an augmented HTML page 513′. This code captures the user selections on the client browser and creates a string representing the locations selected by the user. One way to handle this is by adding an onclick ( ) function for each image. The onclick ( ) function is called when user clicks on the image and captures the location of each such click. In addition, an HTML form is added so the user can submit the PIN selection. For purposes of example, a sample HTML page including the javascript code 517 and the HTML form code 519 may be found in Appendix A hereto. The code found in Appendix A produces a web page for example, like the one shown in
The augmented HTML page 513′ includes:
Step 509: The augmented HTML page 513′ is transmitted to the web browser on the host computer 105 over a secure HTTPS connection.
Step 511: The RAM buffer used for creating this page can now be freed. However, the RAM buffer that holds the map of PIN numbers and their current location in the keypad needs to be saved. It is either kept in RAM, or if RAM space is scarce written to NVM or some other secondary storage.
The server side requirement for the methodology of this approach is that the server be able to support a secure HTTPS connection from the client.
Pin Entry
Step 601: The user positions a cursor and clicks on a number image displayed. This action produces no visual clue as to whether a number image was selected. Therefore, it is very hard for shoulder surfers to guess if a mouse click happened as the user moved his cursor over the image. However, the underlying scripting code has recorded the user selection of a given location in the keypad into an array for that purpose. This process can be repeated until the user has entered the complete PIN. In the example code of Appendix A, the array for recording the user selections is the data structure called “document.vpad.pw.value”.
If at any time while entering the PIN the user realizes that a mistake was made, the user may hit the “Clear” button 407 to clear the selection and start over.
Step 602: After the user has entered the PIN by clicking on the images of keys, the user clicks on the “Login” button 405.
Step 603: In one alternative embodiment, the clicking of the “login” button 405 may trigger some checking before sending the sequence of click locations to the server 101. Thus, clicking on the “login” 405 may invoke a function of the JavaScript code 517 that has been loaded as part of the augmented HTML page 513′ to do some sanity checks on the client web browser. For example, the user can be warned if the exact number of digits required for the PIN has not been entered. Since there is no visual indication to the user that a digit has been selected, this client side check can be useful.
Step 604: If the check fails, the array representing the current user selection is cleared and the user is asked to select the PIN again.
Step 605: If the check in step 3 succeeds, the array of selected number locations is sent to the web server on the server computer 101 as a POST message. The number locations can be sent either as sequential positions, or as coordinates.
PIN Processing
Step 701: First the web server application reads and parses the array of selected user locations as selected by the user using mouse clicks in the procedure illustrated in
Step 702: Next the web server application use the image map saved as part of step 511 of the procedure illustrated in
Step 703: Once the actual PIN has been derived using the map file, the web server application cleans up the temporary buffers from both RAM and NVM. This includes reinitializing the RAM memory used for image map, and deleting all the transformed image files from the underlying file system.
Step 704: Next the web server application compares the actual PIN with the PIN stored in the server 101, e.g., the server being, for example, a network smart card. In one embodiment the comparison is actually done by first generating a one-way hash of the PIN and then comparing the hash value against that stored in user's password file.
Step 705: Finally, the web server application 301″ checks the results of the comparison. If PIN matches, the user is granted access 706, otherwise access is denied and an error page is sent back, step 707.
In one embodiment of the invention, for example as illustrated in Appendix A, each image on the HTML page is a link to a randomized file name. By randomizing the file names, it makes it harder for mal-ware installed on the host computer 105 to detect the files associated with various images. From a performance point of view, this may result in very slow rendering of the login page because each image may require a separate round-trip to the authentication server 301. While that approach may work for a numeric keypad, it could be impractically slow for alphanumeric keypads. In an alternative embodiment, to speed up the display of login page, one design option is to roll all separate images into a single image before sending to the browser. Now the user selection is recorded in the form or image X-Y coordinates. Upon receipt of the locations from the host computer 105, the authentication server 301 then parses these coordinates to determine which image was selected.
Transformation Approach to One-Time Password
In alternative embodiments the randomized image of numbers transmitted from the web server application 301 is not used to select a PIN but rather it is used as an operand in one of several transformation operations that may be used to indicate the user's PIN. In these embodiments the user applies a mathematical transformation to the PIN that user has memorized. The transformation is keyed off some sequence of random numbers that are displayed on the login page. The result of this transformation, a virtual PIN (abbreviated as vPIN below), that can be used as a one-time password (OTP).
Of the four inputs the user has to remember the PIN 805 and the tPIN 803. Depending on the level of security desired by the user or by the overall security scheme, to make it easier for the user to remember both these numbers, the PIN 805 and tPIN may be selected to be identical or some easy function of one another, e.g., the tPIN being the reverse of the PIN.
The transformation logic may either be a public well-known formula or a proprietary authentication server specific formula. In the case of a public well-known formula, the transformation logic may be explained to the user on the log in screen.
The transformation logic can vary in complexity depending upon the security requirement or the comfort level of the user. The logic can be designed in such a way that the selection of a particular transformation PIN can nullify the transformation effect. In this case the virtual PIN is the same as the actual PIN.
Step 901: The random number key 801 is generated by the authentication server 301. Step 903: The user's PIN and tPIN are determined. The PIN determination process can be as simple as reading the PIN and tPIN from the user profile on authentication server 301.
Step 905: The transformation logic to be used is determined. There are many different ways to select transformation logic to be used. For example, the transformation logic may be part of the user profile, or preference on server 301.
Step 907: The PIN, tPIN, and random number key are applied to the transformation logic to determine the vPIN that should be expected from the user.
Step 909: In parallel with these steps to determine the expected vPIN, the random number key 801 is transmitted to the web browser on the host computer 105. Where it is displayed to the user on the web browser login screen. The process by which the user uses the random number key 801 is discussed herein below.
Step 911: At this stage the authorization server waits for and receives the attempted vPIN to be transmitted from the client host computer 105.
Step 913: The attempted vPIN from step 911 and the determined vPIN from step 907 are compared. If they match, the user is allowed access, step 915. Otherwise, an error message 917 is displayed for the user.
The first example of formula-based transformation uses addition and multiplication to transform the PIN 805 into an OTP, the vPIN 811. Since it is the vPIN that is entered, and not the actual PIN, the latter is not compromised. There are two things that are kept secret by the user, a PIN, and a transformation PIN (tPIN). The PIN can be a regular four-digit number that is represented as P1P2P3P4 (e.g. 2459), and the transformation key can be a two-digit number represented as T1T2 (e.g. 13). The login screen that asks the user to enter the PIN for authentication will provide a random number. In this example the random number is a two-digit number represented by R1R2 (e.g. 46), which is transmitted from the authentication server 301 to the host computer 105 in step 909. On the client side, the random number key 801 is displayed on the web browser.
The mathematical transformation to convert the PIN into a virtual PIN that is represented by V1V2V3V4 is executed using two steps. Note: these steps are carried out both by the user who seeks to enter a correct vPIN and the authentication server 301 that determines whether the correct PIN has been entered by the user.
Step 1. Use the transformation key T1T2, and the random number R1R2 to get a conversion offset, step 1001. First each digit of the random number is multiplied with the corresponding digit of the transformation PIN, Step 1003. The resulting numbers are then added (and saved temporarily as offset), Step 1005. The unit digit of this new number is determined, Step 1007. This is the offset, and it can have any value between 0 and 9.
Mathematically the logic is represented as:
Using the aforementioned example values of random number and the transformation PIN, the offset is calculated as follows:
Step 2. Compute the vPIN from the PIN and the offset, Step 1009. The conversion offset from step 1 is added to each digit of the actual PIN to get the corresponding digit of the virtual PIN, Step 1011. In case the resulting digit is greater than 9, only the unit digit (the right most digit) is kept, Step 1013.
In each computation of the virtual PIN digit, only the unit digit is used. For example:
Thus, in the example, the final virtual PIN, V1V2V3V4 is 4671. This is the PIN that is entered at the login page and used by the authorization server 301 to verify that the correct vPIN was entered.
A second approach using a transformation approach to determine a vPIN uses a simpler transformation logic that is based on a single arithmetic computation: addition. This logic is easier to compute as compared to the first example. The user remembers two secrets; a PIN represented by P1P2P3P4 (e.g. 2459) and a transformation PIN represented by T1T2T3T4 (e.g. 3576). The login page displays a 10 digit random number that is indexed from 0 to 9. The index of each digit is shown on top of the random digit for easy identification. For example:
For each digit in the PIN, call it digit i, Step 1103, take that digit of the PIN (in aforementioned example, PIN is 2459, so the first digit is 2) and use this first digit as an index to get the corresponding digit in the random number, Step 1105. Call the RPIN. For the first digit in the PIN in the example, the index value is 2, the corresponding random number (RPIN) is 1.
Next, add the random number, RPIN, (i.e., from the example, RPIN=1) to the corresponding digit of transformation PIN, Step 1107. In the example, the transformation PIN is 3576, the first digit is 3. Therefore, the first digit of virtual PIN is 1+3=4.
If the resulting vPIN digit is greater than 9, only the unit digit is used, Step 1109.
Repeat steps 1105, 1107, and 1109 for the remaining digits in the PIN until all digits of the PIN has been processed.
Using this logic, with a random number array of ‘5710629143’, a PIN of 2459, and a tPIN of 3576, the virtual PIN V1V2V3V4 comes out to be 4199. It is this number that is entered when logging into the system instead of the original PIN. The transformation calculations are:
A further simplification of this logic can be done when selecting the transformation PIN. If all four digits of the transformation PIN are the same, the user only has to remember one digit, which is added to the random numbers. This speeds up the computation required to transform the PIN into a virtual PIN. Similarly, if all the digits of the transformation PIN are ‘0’, there is no need for addition. The transformation process then becomes a simple use of the index to lookup the corresponding digit in the random number array.
The embodiments described in conjunction with
For the first digit, the PIN digit is 2. The corresponding random number digit (in the 2-position) is 1. Adding that number (1) to the PIN digit (2) results in the value 3, which will be the first digit in the vPIN. Continuing in this fashion for the remaining digits, a vPIN of 3072 results.
In an alternative embodiment, the transformation logic rather than generating and transmitting a random number, a matrix of random numbers is generated by the authentication server 301 and transmitted to the host computer 105 for display on the login window. This embodiment removes the overhead of addition. Rather than adding two numbers, the user simply picks a number from the pre-computed matrix. The authentication server 301 generates a 10×10 matrix. The PIN is represented along columns, while transformation PIN is represented along rows.
Each cell in the matrix 1601 is generated by computing the following transformation:
wherein R is an array representing a ten-digit random number transmitted from the authentication server 301 to the web browser on the host computer 105.
Since the user does not perform the additions manually, random number array R does not have to be displayed at the login page. Instead the resulting matrix is displayed. In one embodiment, the html page includes some code for computing the matrix from the random number array. The matrix can either be generated at the authentication server 101, or at the client browser. In the first case the HTML code only displays the matrix; it does not compute it. In the second case Javascript code, transmitted with the HTML code, causes the computation of the matrix using the random number. In both cases the user does not see the random number. The HTML page transmitted from the authentication server 301 includes the requisite code to produce a matrix using the transformation.
In the example of
The intersection of row 3, column 2 gives 6.
The intersection of row 5, column 4 gives 9.
The intersection of row 7, column 5 gives 8.
The intersection of row 6, column 9 gives 3.
While the example of
The background color of alternate rows/columns can be contrasted to help user locate the intersection cell.
In an alternative embodiment of the invention the tPIN and PIN are known by two different users. Thus, to obtain access to a protected service, both users must agree much in the same fashion as two authorized individuals may be required to use separate keys to obtain access to a safe protected by two locks; each has his own key and without both keys neither obtains access.
The iPIN is then transmitted to the host B 1703b, which is operated by user B, step 1807. Alternatively, the authentication server first performs some manipulation of the iPIN before transmitting it to the host B 1703b to further obscure the PIN. The user B then performs a second transformation, e.g., adding the tPIN to the iPIN, step 1809, to obtain an attempted vPIN, which is transmitted back to the authentication server 101, step 1811.
The authentication server 101 then performs an check to determine if the attempted vPIN corresponds to the authorized vPIN, step 1813, and either allows access or denies access, step 1815.
Thus, two users who are in possession of separate authorization numbers, PIN and tPIN, respectively, can cooperate to obtain access to a resource without revealing their respective numbers to each other and without having these numbers revealed to mal-ware, or persons who are attempting to discern these numbers by looking over the user's shoulder.
From the foregoing it will be appreciated that method and system for secure login of the present invention provides an efficient and secure method of entering PINs and passwords whereby the actual values are never exposed. What might be revealed to malicious software are the locations picked by the user attempting to login. However, the malicious software cannot easily determine the digit corresponding to that image location.
Although specific embodiments of the invention have been described and illustrated, the invention is not to be limited to the specific forms or arrangements of parts so described and illustrated. The invention is limited only by the claims.
