# US 2014/0157389 A1 · Server and/or client device authentication > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0157389 A1 - Document ID: US20140157389A1 - Status: Published application - Kind: A1 - Application number: 14/175,115 - Filed: 2014-02-07 - Published: 2014-06-05 - Earliest claimed: 2007-12-28 - Assignees: eBay Inc. - Applicants: eBay Inc. - Inventors: Upendra Mardikar; Kent Griffin; Allison Elizabeth Miller; Amol Patel - Web page: https://patentgrep.com/patent/US20140157389A1 ## CPC - H04L 63/0846: {using time-dependent-passwords, e.g. periodically changing passwords} - H04L 9/3228: {One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/0838: {using one-time-passwords} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04W 12/06: Authentication - H04W 12/12: Detection or prevention of fraud - H04W 12/128: Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 2209/80: Wireless - H04W 12/72: Subscriber identity - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Embodiments of systems and methods for client and/or server authentication are provided. In one embodiment, a method includes sending information from a mobile network device to a server, wherein the information comprises a seed that is used by both the mobile network device and the server to compute a series of one time passwords. The method also includes receiving, by the mobile network device, a succession of one time passwords generated by the server throughout a session. And the method further includes comparing the received one time passwords generated by the server throughout the session to corresponding one time passwords generated at the mobile network device. In this manner, the server can be authenticated. In various embodiments, the process may be reversed to facilitate client, e.g., mobile network device, authentication ## Claims ### Claim 1 A system comprising: one or more processors; and one or more memories adapted to store a plurality of machine-readable instructions which when executed by the one or more processors are adapted to cause the system to: send information from a mobile network device to a server, wherein the information comprises a seed that is used by both the mobile network device and the server to compute a series of one time passwords; receive, by the mobile network device, a succession of one time passwords generated by the server throughout a session; and compare the received one time passwords generated by the server throughout the session to corresponding one time passwords generated at the mobile network device. ### Claim 2 (depends on 1) The system of claim 1, wherein the mobile network device further comprises a cellular telephone, a personal digital assistant, a tablet computer, a laptop computer, or a notebook computer that facilitates access to a network. ### Claim 3 (depends on 1) The system of claim 1, wherein the plurality of machine-readable instructions which when executed by the one or more processors are adapted to further cause the system to: exchange information between the mobile network device and the server during an initial contact between the mobile network device and the server, wherein the information comprises an initial seed that is used by both the mobile network device and the server to compute the series of one time passwords. ### Claim 4 (depends on 1) The system of claim 1, wherein the plurality of machine-readable instructions which when executed by the one or more processors are adapted to further cause the system to: each time that the mobile network device contacts the server, receive, by the mobile network device, a most recent one time password generated by the server; and compare the most recent one time password to a one time password generated by the mobile network device to authenticate the server. ### Claim 5 (depends on 1) The system of claim 1, wherein the plurality of machine-readable instructions which when executed by the one or more processors are adapted to further cause the system to: receive, by the mobile network device, the one time passwords generated by the server periodically during the session. ### Claim 6 (depends on 1) The system of claim 1, wherein the seed that is used by both the mobile network device and the server to compute the series of one time passwords further comprises a token generated based upon a fingerprint of the mobile network device. ### Claim 7 (depends on 6) The system of claim 6, wherein the fingerprint further comprises any information that is representative of or related to the mobile network device. ### Claim 8 (depends on 1) The system of claim 1, wherein the plurality of machine-readable instructions which when executed by the one or more processors are adapted to further cause the system to: if the series of one time passwords generated by the server continue to match the one time passwords generated by the mobile network device, authenticate the server and continue the session; and if a one time password generated by the server does not match a corresponding one time password generated by the mobile network device, then halt the session. ### Claim 9 (depends on 1) The system of claim 1, wherein the plurality of machine-readable instructions which when executed by the one or more processors are adapted to further cause the system to: receive a seed from the server by the mobile network device; generate one or more one time passwords by the mobile network device based on the received seed from the server; and communicate the one or more one time passwords generated by the mobile network device to the server, wherein the server authenticates the mobile network device. ### Claim 10 A method comprising: sending information from a mobile network device to a server, wherein the information comprises a seed that is used by both the mobile network device and the server to compute a series of one time passwords; receiving, by the mobile network device, a succession of one time passwords generated by the server throughout a session; and comparing the received one time passwords generated by the server throughout the session to corresponding one time passwords generated at the mobile network device. ### Claim 11 (depends on 10) The method of claim 10, further comprising: exchanging information between the mobile network device and the server during an initial contact between the mobile network device and the server, wherein the information comprises an initial seed that is used by both the mobile network device and the server to compute the series of one time passwords ### Claim 12 (depends on 10) The method of claim 10, further comprising: each time that the mobile network device contacts the server, receiving, by the mobile network device, a most recent one time password generated by the server; and comparing the most recent one time password to a one time password generated by the mobile network device to authenticate the server. ### Claim 13 (depends on 10) The method of claim 10, further comprising: receiving, by the mobile network device, the one time passwords generated by the server periodically during the session. ### Claim 14 (depends on 10) The method of claim 10, wherein the seed that is used by both the mobile network device and the server to compute the series of one time passwords further comprises a token generated based upon a fingerprint of the mobile network device. ### Claim 15 (depends on 14) The method of claim 14, wherein the fingerprint further comprises any information that is representative of or related to the mobile network device. ### Claim 16 (depends on 10) The method of claim 10, further comprising: if the series of one time passwords generated by the server continue to match the one time passwords generated by the mobile network device, authenticate the server and continue the session; and if a one time password generated by the server does not match a corresponding one time password generated by the mobile network device, then halt the session. ### Claim 17 (depends on 10) The method of claim 10, further comprising: receiving a seed from the server by the mobile network device; generating one or more one time passwords by the mobile network device based on the received seed from the server; and communicating the one or more one time passwords generated by the mobile network device to the server, wherein the server authenticates the mobile network device. ### Claim 18 A non-transitory computer readable medium on which are stored computer readable instructions and, when executed by a processor, cause the processor to: send information from a mobile network device to a server, wherein the information comprises a seed that is used by both the mobile network device and the server to compute a series of one time passwords; receive, by the mobile network device, a succession of one time passwords generated by the server throughout a session; and compare the received one time passwords generated by the server throughout the session to corresponding one time passwords generated at the mobile network device. ### Claim 19 (depends on 18) The non-transitory computer readable medium of claim 18, wherein the computer readable instructions further cause the processor to: receive, by the mobile network device, the one time passwords generated by the server periodically during the session. ### Claim 20 (depends on 18) The non-transitory computer readable medium of claim 18, wherein the computer readable instructions further cause the processor to: if the series of one time passwords generated by the server continue to match the one time passwords generated by the mobile network device, authenticate the server and continue the session; and if a one time password generated by the server does not match a corresponding one time password generated by the mobile network device, then halt the session.