Abstract: Access control for a memory device is provided. In one embodiment, a portable memory device is provided comprising a storage medium comprising a private area and circuitry operative to (a) receive, from a host device, a password to unlock the host device, (b) compare the password with a password stored in the portable memory device, and (c) if the passwords match, allow the host device to access the private area. In another embodiment, a portable memory device is provided comprising a storage medium comprising a private area and a public area. The public area stores computer-readable program code to facilitate interaction with the access control features of the portable memory device. Methods for use with such memory devices are also provided. Other embodiments are disclosed, and each of the embodiments can be used alone or together in combination.

Abstract: A method and system for protecting identity information comprises determining identity information required by a resource utilized by a user, determining strength of the identity information used by the user to access the resource, and performing an action in view of the strength.

Abstract: In a method for issuing a digital certificate by a certification authority (B), a device (A) sends a request message to the certification authority (B) for issuing the certificate, the certification authority (B) receives the request message and sends a request for authenticating the device (A) to the device (A), the device (A) sends a response to the certification authority (B) in response to the received request, and the certification authority (B) checks the received response and generates the certificate and sends the certificate to the device (A), if the response was identified as correct.

Abstract: The disclosure provides a system and method of authenticating a user to a network. For the method, if a request for a resource initiated by the device is related to a restricted resource, then the method: redirects the request to the authentication server; initiates an authentication process at the server to request a user account and a password from the device to authenticate the device if it has not been authenticated; automatically provides the device with access to the restricted resource if the device previously had been authenticated to access the restricted resource; and provides a signal to the device indicating whether it has been authenticated to allow the device to update its graphical user interface to indicate an access status for the restricted resource. If the request relates to a non-restricted resource, then the method automatically provides the device with access to the non-restricted resource.

Abstract: A method, computer program product and system of preventing the unauthorized rebooting of a server having a change record, reboot password and valid reboot key. The method includes authenticating that rebooting is authorized by the change record; responsive to entering a reboot password, authenticating that a valid reboot password has been entered; and responsive to entering a reboot key, authenticating by a computer processor that a valid reboot key has been entered.

Abstract: In one example embodiment, an information processing apparatus determines whether a target ID is a unique ID or a partial randomization ID that includes a first part being replaced by a different number and a second part being generated based on the unique ID. In response to the target ID being the partial randomization ID, the information processing apparatus generates an access key based on the second part of the partial randomization ID and a key. The information processing apparatus executes a mutual authentication process using the generated access key.

Abstract: A system and method of distributing authentication information for remotely accessing a computer resource. A request for authentication information, including identity information, is received from a user of a remote device. When the user is authenticated based on the identity information, requested authentication information is retrieved and returned to the remote device. The authentication information, or information generated from the authentication information, is then used for remotely accessing the computer resource.

Abstract: This invention relates to a method and a system for generating user passcodes for each of a plurality of transaction providers from a mobile user device. A method and system for activating a plurality of passcode generators on a user device configured with a passcode application installed on the user device is provided. Each of the passcode generators may correspond to a different user account or transaction provider, such that each passcode generator provides a user passcode configured for the corresponding account or transaction provider. One or more of the passcode generators may include a passcode generating algorithm and a passcode key. Access to one or more of the passcode generators may require providing a PIN or a challenge.

Abstract: Systems and methods for authenticating a user of a service are disclosed. A host of a service provides a user interface that can be accessed via a display of a terminal. Upon successfully transmitting a first set of credentials, the host requests a random image to be generated by an authentication server. The authentication server transmits the random image to the host, as well as to a mobile device that is associated with the user of the service. The mobile device receives a picture message including the image. The user interface displays a list of images on the display. The user matches the received image with an image among the list of images, wherein a successful match follows in the user being granted access to the service. Consequently, an additional layer of security using a visual identification of a user is provided.

Abstract: A password authentication mechanism is capable of determining whether a password has expired without referring to a database or other information repository. Additional information can be encoded in the password without unduly lengthening the password, so that the additional information can be extracted from the password when the user provides the password for authentication purposes. Thus, the password serves as an information-carrying data item as well as acting as an authentication mechanism. Such a password can be used, for example, to provide time-limited access to a vehicle in response to receipt of timely payment, and to disable the vehicle if payment is not made.

Abstract: A method for generating a password for a user account. The method includes selecting a media item from a media library associated with a user; selecting a portion of the media item; generating a password based on the selected portion of the media item, where at least a portion of the password is based on selecting a first letter of a word included in the portion of the media item; and presenting the password as a suggested password to the user.

Abstract: According to one embodiment, an authenticator which authenticates an authenticatee, which stores first key information (NKey) that is hidden, includes a memory configured to store second key information (HKey) which is hidden, a random number generation module configured to generate random number information, and a data generation module configured to generate a session key (SKey) by using the second key information (HKey) and the random number information. The authenticator is configured such that the second key information (HKey) is generated from the first key information (NKey) but the first key information (NKey) is not generated from the second key information (HKey).

Abstract: An information processing device including a flow definition memory unit configured to store flow definition information in which a process flow of image data read by an image reading unit is defined, and an authentication screen generating unit configured to determine plural processing units that execute a part of the process flow based on the flow definition information, acquire item information indicative of items of authentication information corresponding to a part or all of the plural processing units which require authentication from the part or all of the plural processing units which require the authentication, and generate authentication screen definition information used for displaying an authentication screen integrating and showing the item information.

Abstract: A method and apparatus for client authentication using a pseudo-random number generation system. The pseudo-random number generation utilizes a secret key as well as state information as input into the hash function to generate a pseudo-random number. The state information that is part of the input can be any number of prior generated pseudo-random numbers. The authentication allows for synchronization of the client and server by exchanging state information. The authentication is not dependent on any absolute time and consequently the client and servers are not required to maintain a reliable shared time base.

Abstract: The present invention discloses a dynamic token seed key injection and deformation method. The method comprises steps of: generating in advance an initial seed key for a token and injecting the initial seed key into the token during manufacture; when distributing the token to an end user, performing an activation operation, and obtaining a new seed key, which is the final seed key for the future work of the token, by performing an operation based on an active code and the initial seed key; meanwhile, introducing the initial seed key into a dynamic password authentication system which performs the same deformation operation for the seed key as that performed in the token to obtain the same new seed key. After the activation operation in the token and the authentication system in this way, the final new seed key is different from the initial seed key injected by the token manufacturer, so that the privacy of the seed key is strengthened.

Abstract: A method for inhibiting phishing can include sending information from a mobile network device to a website server, generating a one time password at the mobile network device from the information, generating a one time password at the website server from the information, sending the one time password generated at the website server to the mobile network device when the mobile network device subsequently accesses the website, and comparing the one time password generated at the website server to the one time password generated at the mobile network device. In this manner, the website can be authenticated such that the occurrence of phishing is substantially mitigated.

Abstract: A method and system is provided for using an access list stored on a memory of a first computing device, the access list for controlling communication between the first computing device and a plurality of computing devices in a Bluetooth communication network.

Abstract: A system of screening servers, screener client computers, and screening kiosks distribute an applicant screening process among multiple sites and multiple participants. To facilitate and secure communications of screening results and applicant actions, a personal identification code is provided that identifies individual sets of screening results. In this manner, the applicant is authenticated and can then enter appropriate applicant profile data into a secure screening account, such as via a screening kiosk. Screening results may be generated for the applicant in association with a unique personal identification code. This code can then be communicated to the screener, who can access the screening results along with a recommendation, if desired, by sending the code to a screening server. The screener can also enter appropriate screening information into another secure screening account.

Abstract: A system and method is provided for generating a one-time passcode (OTP) from a user device. The method includes providing a passcode application and a cardstring defined by a provider account to the user device. The passcode application is configured to generate a passcode configured as a user OTP for the provider account, using the cardstring. The cardstring is defined by at least one key camouflaged with a personal identification number (PIN). The key may be camouflaged by modifying and encrypting the modified key under the PIN. The key may be configured as a symmetric key, a secret, a seed, and a controlled datum. The cardstring may be an EMV cardstring; and the key may be a UDKA or UDKB. The cardstring may be an OTP cardstring, and the key may be a secret configurable to generate one of a HOTP, a TOTP, and a counter-based OTP.

Abstract: A method, system and computer-usable medium for providing secure access to an application over an unsecure network. A transparent identification member can be physically placed by a user against a login interface, the transparent identification member possessing a filter for filtering and displaying a pattern unique to the login interface. Thereafter, the user can be automatically permitted to authenticate an unsecure network and securely access an application over the unsecure network, in response to placing the transparent identification member against the login interface and providing a user input at a physical location on the login interface corresponding to the pattern unique to the login interface, thereby providing a secure authentication for the user to perform secure transactions over the unsecure network and preventing phishing by others with respect to the user and the unsecure network.

Abstract: An authentication system is provided that includes a portable device and a decryption node. An individual uses the portable device, such as a portable device like a cell phone to compute a challenge and a response. The challenge and response is sent to a decryption node. In response, the decryption node computes a presumed response and compares the presumed response to the response of the portable device, in order to authenticate the individual associated with the portable device.

Abstract: A method for resetting Internet access account passwords can include the step of connecting a user with an interactive voice response system (IVR). At least one access account associated with the user can be determined. The IVR can validate that the user is authorized to access the access account. The IVR can then cause a password associated with the at least one access account to be reset. The IVR can also present the reset password to the user.

Abstract: An apparatus and method for unlocking a user equipment. The apparatus may include a first input unit, a second input unit, a controller, and a memory. The first input unit may be configured to set up a first password and to receive a first input. The second input unit may be configured to set up a second password and to receive a second input. The controller may be configured to compare the first input with the first password, compare the second input with the second password, and initiate an unlock operation of the user equipment based on a result of the comparisons. The memory may be configured to store at least the first password and the second password.

Abstract: A password protection application is executed on a mobile device and provides an interface by which an authorized user can define and configure a “data protection profile” for the device. This profile defines at least one security event (criteria or condition) associated with the device, and at least one protection action that should occur to protect data on the device upon the triggering of the event. Once defined in a profile, the application monitors for the occurrence of the security event. Upon the occurrence of the specified event, the protection action is enforced on the device to protect the data.

Abstract: A blind hashing system and method are provided in which blind hashing is used for data encryption and secure data storage such as in password authentication, symmetric key encryption, revocable encryption keys, etc. The system and method include using a hash function output (digest) as an index or pointer into a huge block of random data, extracting a value from the indexed location within the random data block, using that value to salt the original password or message, and then hashing it to produce a second digest that is used to verify the password or message, encrypt or decrypt a document, and so on. A different hash function can be used at each stage in the process. The blind hashing algorithm typical runs on a dedicated server and only sees the digest and never sees the password, message, key, or the salt used to generate the digest.

Abstract: A system for enhancing security of a personal identification number is configned for performing a method that includes receiving, from a first entity having an input permission, a first data structure into a HSM, wherein the first data structure maps a first many-to-one mapping between a first and a second PIN numeral system. The method also includes determining whether the content of the first data structure is valid, storing the first data structure in the HSM if the first data structure is valid and marking the stored first data structure as inactive. The method further includes activating the first data structure if a second data structure is input into the HSM by a second entity having an activation permission, wherein the first entity is different from the second entity, the first data structure is identical to the second data structure. The method additionally includes converting from the first to the second PIN numeral system responsive to the activated first data structure.

Abstract: A system and method for automatic authentication includes automatically calculating a security code on a computer running a security program. The security program resides on the same computer as a web browser. In response to a user signing into a web based account on a web site accessed by the web browser, automatically verifying that the security program is registered with the web based account. In response to a second factor security code entry request on the web based account, automatically entering the security code into the web based account. The security code is transmitted to the web site transparently to the user for login.

Abstract: A phishing detection client component and method is provided. The component can be employed as part of a system to detect and, optionally, prevent phishing attacks. The phishing detection client component can provide password reuse event report(s), for example, to a phishing detection server component. The client component can further include a credential component that can track use of credentials by a user and determine whether a specific security credential is being used or presented. Due to the malicious nature of phishing in general, the client component can be susceptible to attacks by phishers. For example, phishers can generate false logins in an attempt to flood the client component with information resulting in induced false positives and/or induced false negatives. The client component can perform one or more checks to determine whether false login(s) have been attempted.

Abstract: A client hosted virtualization system (CHVS) includes a processor to execute code, a security processor, a component that includes a certificate, and a non-volatile memory. The non-volatile memory includes BIOS code for the CHVS and virtualization manager code to initialize the CHVS, launch a virtual machine on the CHVS, and authenticate the component with the security processor by determining that the certificate is valid. The CHVS is configurable to execute the first code and not the second code, or to execute the second code and not the first code.

Abstract: A system and method for distributing symmetric keys in a system including an end-user computer operated by an end-user, a service provider server of a service provider having a service provider identifier, and a manufacturer backend server operated by the manufacturer of the OTP token. The manufacturer backend server operates to verify one-time passwords generated by the OTP tokens and upon verifying the authenticity of the OTP token based on the generated passwords, transmitting the symmetric key to a service provider server or an authentication server. Other systems and methods are disclosed.

Abstract: A method and apparatus are provided for extracting information from a user's memory that will be easily recalled during future authentication yet is hard for an attacker to guess. The information might be a little-known fact of personal relevance to the user or the personal details surrounding a public event. The user is guided to appropriate topics and forms an indirect hint that is useful to the user yet not to an attacker. Information extraction techniques verify that the information is not easily attacked and to estimate how many bits of assurance the question and answer provide. The information extracted may be, e.g., Boolean (Yes/No), multiple choice, numeric, textual, or a combination of the foregoing. The enrollment process may schedule the sending of one or more reminder messages to the user containing the question (but not the answer) to reinforce the memory of the user.

Abstract: A method for entering password and a portable electronic device using the same, a method for unlocking the portable electronic device and a data authenticating method are provided, wherein the portable electronic device includes a touch screen. The method includes displaying an interface for entering a somatosensory password, measuring and recording at least one angle variation of the portable electronic device on at least one dimension, and generating a somatosensory signal data set according to the at least one angle variation of the portable electronic device on the at least one dimension. The method further includes generating a user password data according to the somatosensory signal data set, encrypting the user password data according to an encryption algorithm to generate an encrypted user password data, and transmitting the encrypted user password data to an authentication unit.

Abstract: In regard to a radio-controlled communication system (1), which comprises a base station (2) and at least one single mobile part (3), a registration procedure, which is simplified for a user, is proposed for registering the mobile part (3) at the base station (2). The registration procedure operates such that upon a first PIN request by the base station (2) to the mobile part (3), the mobile part (3) automatically transmits a so-called default PIN to the base station (3). If said default PIN is correct, the registration procedure is successful. If said default PIN is incorrect, the base station (2) checks for the existence of the so-called default PIN. If said default PIN does not exist, the registration procedure is ended. If the PIN exists, a user of the mobile part (3) receives the possibility to manually input the PIN, and the registration procedure is continued upon the check of the transmitted PIN for correctness.

Abstract: An embodiment of the invention is directed to a data processing system having a plurality of users, a portion of which were previously assigned permissions respectively corresponding to system resources. The embodiment includes acquiring data from a first data source, containing information pertaining to the portion of users and their permissions, and further includes acquiring data from a second data source, containing information pertaining to attributes of each user of the plurality. A set of permissions is determined for a given role, from both first and second data sources. First and second criteria are determined for assigning users to the given role, from information in the first and second data sources, respectively. A particular user is selected for admission to the given role only if the particular user is in compliance with both the first criterion and second criterion.

Abstract: A method of authenticating a user of a computing device is proposed, together with computing device on which the method is implemented. In the method a modified base image is overlaid with a modified overlay image on a display. The modified overlay image comprises a plurality of numbers. At least one of the modified base image and modified overlay image is moved by the user. Positive authentication is indicated in response to the base image reference point on the modified base image being aligned, in sequence, with two or more numbers from the overlay image that equal a pre-selected algebraic result when one or more algebraic operator is apply to the numbers.

Abstract: A system of screening servers, screener client computers, and screening kiosks distribute an applicant screening process among multiple sites and multiple participants. To facilitate and secure communications of screening results and applicant actions, a personal identification code is provided that identifies individual sets of screening results. In this manner, the applicant is authenticated and can then enter appropriate applicant profile data into a secure screening account, such as via a screening kiosk. Screening results may be generated for the applicant in association with a unique personal identification code. This code can then be communicated to the screener, who can access the screening results along with a recommendation, if desired, by sending the code to a screening server.

Abstract: The present invention relates to a system and method for secure verification of electronic transactions, and in particular secure processing of personal identification numbers when third party processors are involved. In an embodiment, a variable length PIN associated with a credit card or debit card is encrypted, then hashed using a one-way hash algorithm before it is passed along to and stored by a third party processor. The encrypted-hashed PIN always remains in an encrypted form while in the hands of the third party processor. At the third party processor, secure cryptographic hardware is used to store the one-way hash algorithm. Encrypted PIN values received for verification are converted and hashed using the one-way hash algorithm, and the resulting hashed-encrypted value is compared against the hashed-encrypted PIN values previously stored at the third party processor.

Abstract: Embodiments for providing differentiated access based on authentication input attributes are disclosed. In accordance with one embodiment, a method includes receiving an authentication input at an authentication authority using an authentication protocol. The authentication input being associated with a client. The method also includes providing one or more representations for the authentication input, wherein each of the representations represents an attribute of the authentication input.

Abstract: A computationally implemented method includes, but is not limited to: determining that a computing device used by a first user has been transferred from the first user to a second user; ascertaining, in response to said determining, which of one or more items that are at least conditionally accessible through the computing device are active; and providing one or more selective levels of access to the one or more items based, at least in part, on said ascertaining. In addition to the foregoing, other method aspects are described in the claims, drawings, and text forming a part of the present disclosure.

Abstract: A static password is converted into a One-Time Authenticator (OTA) in accordance with a one-time keyboard map. The one-time keyboard map is generated in accordance with a nonce and a secret shared by the user entering the static password and an intended recipient. In response to receiving a prompt to enter a password, a user positions a display cursor within a designated display area. In response thereto, the keyboard driver generates the one-time keyboard map to remap the entered static password. The remapped password is converted into an OTA and transmitted instead of the static password. When the display cursor is moved out of the designated display area, the one-time keyboard map is no longer used to convert keystrokes and the keyboard mapping reverts back to its previous, original configuration.

Abstract: This invention relates to a method and a system for generating user passcodes for each of a plurality of transaction providers from a mobile user device. A method and system for activating a plurality of passcode generators on a user device configured with a passcode application installed on the user device is provided. Each of the passcode generators may correspond to a different user account or transaction provider, such that each passcode generator provides a user passcode configured for the corresponding account or transaction provider. One or more of the passcode generators may include a passcode generating algorithm and a passcode key. Access to one or more of the passcode generators may require providing a PIN or a challenge.

Abstract: Embodiments of the present invention may detect an access attack by analyzing the passwords from successive access requests in an access session or by analyzing successive access attempts to determine patterns in the access information. For example, the analysis may consist of examining the access information to determine cycling in passwords of the access information. Cycling passwords may consist of password that are varied in a predictable or repetitive manner such as “aaaa”, “aaab”, “aaac”, “aaad”, etc. In addition, the usernames and passwords from successive access requests in an access session are analyzed to determine patterns in both the usernames and passwords. The analysis may consist of examining the access information to determine the use of identical passwords for various usernames. The analysis may also detect the cycling of passwords across multiple usernames.

Abstract: A computationally implemented method includes, but is not limited to: determining that a computing device used by a first user has been transferred from the first user to a second user; ascertaining, in response to said determining, which of one or more items that are at least conditionally accessible through the computing device are active; and providing one or more selective levels of access to the one or more items based, at least in part, on said ascertaining. In addition to the foregoing, other method aspects are described in the claims, drawings, and text forming a part of the present disclosure.

Abstract: A method and apparatus to prove user assertions. A client request to authenticate a user assertion pertaining to user personal data may be received. The requested authentication may be generated for the client, the authentication proving the user assertion without revealing other information about the user. The requested authentication may be sent to the client.

Abstract: A method for secure identification of stations connected over data communications networks during a transaction, comprising transmitting, on the part of a first station to a second station, an identification index of a reference cell in a sequence of codes known to both stations and a first code in the sequence and chosen according to a first criterion known to both stations; identifying, by the second station, a cell in the sequence through the received index; verifying the first code by the second station; transmitting, by the second station toward the first station, a second code, in the series of codes calculated according to a second criterion known to both stations; verifying by the first station, the correctness of the second code; marking, by the first station and preferably also by the second station, the indices related to the codes that have been used as unusable for subsequent transactions.

Abstract: Techniques for user authentication are disclosed. In some situations, the techniques include receiving, from a client device, an authentication request to access a network resource, the request including a user identifier, obtaining a security credential associated with the user identifier contained in the received request, generating an authorization code based on the obtained security credential, providing to the client device instructions to obtain first information corresponding to the generated authorization code, receiving, from the client device, the first information provided in response to the provided instructions, and, when the first information received from the client device corresponds to at least a portion of the generated authorization code, authorizing the client device to access the network resource.

Abstract: A method is provided for generating a human readable passcode to an authorized user including providing a control access datum and a PIN, and generating a unique machine identifier for the user machine. The method further includes modifying the controlled access datum, encrypting the controlled access datum using the PIN and/or a unique machine identifier to camouflage the datum, and generating a passcode using the camouflaged datum and the PIN and/or the unique machine identifier. A mobile user device may be used to execute the method in one embodiment. The passcode may be used to obtain transaction authorization and/or access to a secured system or secured data. The unique machine identifier may be defined by a machine effective speed calibration derived from information collected from and unique to the user machine.

Abstract: Methods of operating memory systems and memory systems are disclosed, such as a memory system having a memory array storing a code generating program to instruct a processor to generate a code, and a register to store a code generated by the processor, where the register is configured to allow a write operation to the memory array in response to a match of a code stored in the register and where the match is controlled in response to a request from a utility program being executed by the processor.

Abstract: A biometric authentication device performs authentication of a user based on biometric information. In the biometric authentication device, a registry information storage stores pre-registered biometric information as registry information. An acceptance value determiner determines a verification acceptance value used for authentication, based on quality of the registry information with regard to reliability of characterizing an individual. An authentication information acquirer obtains biometric information of a user as authentication information. A similarity calculator compares the authentication information of the user with the registry information and calculates similarity between the authentication information and the registry information. An authenticator identifies whether the user is a registrant corresponding to the registry information, based on the similarity and the verification acceptance value.

Abstract: A secure storage system is disclosed. The secure storage system comprises a crypto engine and a storage device. The crypto engine comprises a random number generator; a hash function; a general encryption engine; and a data encryption engine. The secure storage system further includes a storage device coupled to the crypto engine. The storage device includes a storage array. The storage array includes a public partition, a secure partition and a system partition. The public partition is accessible to the public. The secure partition is accessible through the password authentication. The system partition is accessible only by the secure storage system. The password authentication is two-level instead of one, to avoid hash collision or insider tampering. The secure partition is accessed with “access gating through access key” instead of “access control through comparison.” The password can be changed without reformatting the secure storage.