Abstract: An interactive mutual authentication protocol, which does not allow shared secrets to pass through untrusted communication media, integrates an encryption key management system into the authentication protocol, so that key management becomes an essential part of the authentication protocol itself. The system provides a secure distribution of a secret session random key used in symmetric cryptography. Successful exchange of this encryption key allows for secure transit of the protocol data over communication lines in encrypted form, permitting explicit mutual authentication of the connected parties. The post-authentication stage of the communication session can use secure encryption for the data exchange, since each party has already obtained the secret session random key.

Abstract: An interactive mutual authentication protocol, which does not allow shared secrets to pass through untrusted communication media, integrates an encryption key management system into the authentication protocol. The server encrypts a particular data random key by first veiling the particular data random key using a first conversion array seeded by a shared secret, and then encrypting the veiled particular data random key. The client decrypts and unveils the particular data random key using the shared secret, and returns a similarly veiled version of the particular data random key using a second conversion array seeded by a shared secret. Access to the shared secret indicates authenticity of the stations. The procedure may be repeated for a second shared secret for strong authentication, without allowing shared secrets to pass via untrusted media.

Abstract: An interactive mutual authentication protocol, which does not allow shared secrets to pass through untrusted communication media, integrates an encryption key management system into the authentication protocol. The server provides ephemeral encryption keys in response to a request during a Session Random Key (SRK) initiation interval. SRK is provided for all sessions initiated in the SRK initiation interval. A set of ephemeral intermediate Data Random Keys (DRK) is associated with each request. A message carrying the SRK is sent to the requestor. A response from the requester includes a shared parameter encrypted using the SRK verifying receipt of the SRK. After verifying receipt of the SRK at the requester, at least one message is sent by the server carrying an encrypted version of one of said set of ephemeral intermediate DRK to be accepted as an encryption key for the session.

Abstract: An authentication server provides a clue to a client indicating a random partial subset of a full pattern that characterizes a full digitized path on a frame of reference, and the client enters a data to fulfill an authentication factor suggested by the clue. The full pattern consists of an ordered set of data fields, which store parameters that specify the full digitized path on a reference grid for recognition. The server presents an instance of a graphical representation of the frame of reference, including an array of random indicators at data field coordinates in the frame of reference. The server accepts indicators from the array of indicators corresponding to coordinates along said digitized path identified by the random partial subset as input data to fulfill the authentication factor.

Abstract: A system for authentication of a client includes logic supporting combinations of more than one a “what user knows” authentication factors for strong authentication of a client, such as a static password, random partial pattern recognition factor and a random partial digitized path recognition factor. An interactive method for authentication of a client in a network environment utilizes two or more “what user knows” authentication factors. The two or more “what user knows” authentication factors are algorithmically and parametrically independent. The client is prompted to provide a server the first “what user knows” authentication factor over a communication medium. The server verifies the first “what user knows” authentication factor. If successful, then the client is prompted to provide the server the second “what user knows” authentication factor.

Abstract: A system for authentication of a client includes logic supporting a “what user knows” algorithm for authentication of a client, such as a random partial pattern recognition algorithm, based upon client credentials including an account user name and an account authentication code. Logic supporting client account administration is operable without human intervention on the server side, and includes at least one mode of operation that presents an interface to a client via the data network having at least two tiers of security based on input by the client of secret information shared only between the client and the server. A first tier in said at least two tiers requires entry of one of the account user name and user's email address, and a second tier in the at least two tiers requires entry of one of client profile data sufficient to identify the client and at least a subset of said account authentication code.

Abstract: A graphical user interface supports an interactive client-server authentication based on Random Partial Pattern Recognition algorithm (RPPR). In RPPR, an ordered set of data fields is stored for a client to be authenticated in secure memory on the server side. A graphical user interface presents a clue generated at the server to the client, such positions in the ordered set of a random subset of data fields from the ordered set. The client enters input data in multiple fields of the interface according to the clue, and the server accepts the input data from the client. The input data includes storage units representing alpha-numeric characters, images and colors corresponding to the field contents for the data fields. The interface includes indicators for elapsed time and status of the authentication session.

Abstract: An interactive client-server authentication system and method are based on Random Partial Pattern Recognition algorithm (RPPR). In RPPR, an ordered set of data fields is stored for a client to be authenticated in secure memory. An authentication server presents a clue to the client via a communication medium, such positions in the ordered set of a random subset of data fields from the ordered set. The client enters input data in multiple fields according to the clue, and the server accepts the input data from the client via a data communication medium. The input data corresponds to the field contents for the data fields at the identified positions of the random subset of data fields. The server then determines whether the input data matches the field contents of corresponding data fields in a random subset.