# US 2019/0379653 A1 · Accelerated communication attack detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0379653 A1 - Document ID: US20190379653A1 - Status: Published application - Kind: A1 - Application number: 16/529,848 - Filed: 2019-08-02 - Published: 2019-12-12 - Earliest claimed: 2013-04-08 - Assignees: Titanium Crypt, Inc. - Applicants: Titanium Crypt, Inc. - Inventors: Craig MEAD - Web page: https://patentgrep.com/patent/US20190379653A1 ## CPC - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/0838: {using one-time-passwords} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 2463/082: applying multi-factor authentication - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for detecting an attack on a communications channel, while authenticating a user of a client device at a server or peer-to-peer or multi-peer connection is provided. The method includes: monitoring the line latency, as detected by a rapid-fire exchange of a nominal number of bytes and comparing the round trip reply latency to expected values, forming keys created by collecting information regarding the hardware, software, connection speed, or network information related to the client device or biometric information related to the user, encrypting data, using a computer microprocessor associated with the client device, with the subset of characters of the username or password, one-time-use password, or collected information, transmitting the encrypted data from the client device to the server via a network link therebetween, and decrypting the data, at the server, using a server-side copy of the username, password, and collected information. ## Claims ### Claim 1 A method for detecting an attack on a communications channel, while authenticating a user of a client device at a server or peer-to-peer or multi-peer connection, the method comprising: monitoring the line latency, as detected by a rapid-fire exchange of a nominal number of bytes and comparing the round trip reply latency to expected values; forming keys created by collecting information regarding the hardware, software, connection speed, or network information related to the client device or biometric information related to the user; encrypting data, using a computer microprocessor associated with the client device, with the subset of characters of the username or password, one-time-use password, or collected information; transmitting the encrypted data from the client device to the server via a network link therebetween; and decrypting the data, at the server, using a server-side copy of the username, password, and collected information. ### Claim 2 (depends on 1) The method of claim 1, further comprising: testing a transmission time between the client device and the server for a time greater than a threshold associated with normal transmission times; and determining that a man-in-the-middle attack is occurring if the time is greater than the threshold. ### Claim 3 (depends on 1) The method of claim 1, wherein, upon receipt of the client's message created using a strong encryption key: the server: selects one or more potential clients from a database of clients on the server using the encrypted data received by the server, along with the encrypted data created by the client; attempts to decrypt the client's data using a formed key, determined by the server by reproducing the key from stored parameters on the server of known clients with matching hardware, software and when available, historic connection parameters, to attempt to decrypt the client data; if successful in indicating a matching client with similar hardware and software parameters has been found, uses the matching client's next one-time password and optional two-factor authentication, both stored on the server, to re-encrypt the client's data; and transmits the re-encrypted data to the client; wherein the client can only decrypt the server's re-encrypted data by entering a full password and optional two-factor authentication; the client verifies that the re-encrypted data is the same as the encrypted data, which only an authentic server in possession of the next one-time password and optional two-factor authentication can create; establishing a set of temporary shared keys using the hardware and software parameters and connection parameters when available, as well as the partial username, one-time password, and optional two-factor authentication; the client uses the shared keys to encrypt and transmit to the server the first package of an encrypted algorithm exchange to establish a larger key a secure utilizing an encrypted Diffie-Hellman exchange or other secure algorithm, which is immune to a “Spoiler Attack” when the shared parameters are transmitted in an encrypted format; if the server fails to decrypt the client's encrypted data within a short period of time or a period set by the server administrator, the client restarts the current connection and presumes that one of the following has occurred: the current connection timed out; the server is not authorized; an attacker is attempting to intercept and compute the keys; or an attacker has used an erroneous or otherwise invalid one-time password to encrypt the data; if the client fails to decrypt the server's re-encrypted data and respond with the secure algorithm package within a short period of time or a period set by the server administrator, the server presumes that one of the following has occurred: the connection timed out; the user is not authorized; an attacker created a login attempt with erroneous or otherwise invalid credentials including hardware, software, or connection parameters that do not match anything in the server's historical database; or an attacker is attempting to compute the password, causing an unexpected extended period of delay between replies. ### Claim 4 (depends on 3) The method of claim 3, wherein, when the client fails to decrypt the server's re-encrypted data and respond with the secure algorithm package within a short period of time or a period set by the server administrator, the server: terminates the connection, resetting all parameters; terminates any further communication on a port if the number of consecutive failures indicates a Denial of Service attack may be in progress; or allows the client an opportunity to use a series of challenge questions to verify its identity. ### Claim 5 (depends on 1) The method of claim 1, wherein the transmitting comprises: sending a plurality of messages from the client to the server; and receiving, in response to each message, a response from the server to the client, wherein at least one message sent from the client to the server includes information derived from a previously-received response from the server. ### Claim 6 (depends on 3) The method of claim 3, wherein, when the server allows the client an opportunity to use a series of challenge questions to verify their identity, the server prompts the user for an answer to a challenge question if the subset of characters in the username does not match a reference value or if the one-time-use password does not match a reference value. ### Claim 7 (depends on 3) The method of claim 3, wherein, when the client fails to decrypt the server's re-encrypted data and respond with the secure algorithm package within a short period of time or a period set by the server administrator, the server prompts the user for an answer to a challenge question if a processing ability of the client device is below a threshold. ### Claim 8 (depends on 3) The method of claim 3, wherein the creating a larger key for subsequent encryption comprises determining a strength of encrypting based on a processing ability of the client device. ### Claim 9 (depends on 1) The method of claim 1, further comprising downloading, from the server to the client device, a software application for collecting the information. ### Claim 10 (depends on 9) The method of claim 9, wherein the software application is selected from a pool of candidate software applications. ### Claim 11 (depends on 10) The method of claim 10, wherein the server periodically or randomly varies the software application downloaded to the client device. ### Claim 12 (depends on 3) The method of claim 3, further comprising prompting the user to enter a temporary two-factor authentication code. ### Claim 13 (depends on 3) The method of claim 3, further comprising: testing a transmission time between the client device and the server for a time greater than a threshold associated with normal transmission times; and determining that a man-in-the-middle attack is occurring if the time is greater than the threshold. ### Claim 14 (depends on 3) The method of claim 3, wherein the encrypting further comprises increasing a strength of the encrypting in response to the determined attack, or hardware or software parameters, or shared network conditions. ### Claim 15 (depends on 3) The method of c claim 3, wherein the transmitting the encrypted data comprises: sending a plurality of messages from the client to the server; and receiving, in response to each message, a response from the server to the client, wherein at least one message sent from the client to the server includes information derived from a previously-received response from the server. ### Claim 16 (depends on 3) The method of claim 3, wherein, when a login fails, the client prompts the user for an answer to a challenge question if the subset of characters in the username does not match a reference value or if the one-time-use password or optional two-factor authentication does not match a reference value. ### Claim 17 (depends on 3) The method of claim 3, wherein, when a login fails, the client prompts the user for an answer to a challenge question if a processing ability of the client device is below a threshold. ### Claim 18 (depends on 3) The method of claim 3, wherein the encrypting comprises determining a strength of encrypting based on a processing ability of the client device. ### Claim 19 (depends on 1) The method of claim 1, wherein the transmitting the encrypted data comprises: sending a plurality of messages from the client to the server; and receiving, in response to each message, a response from the server to the client, wherein at least one message sent from the client to the server includes information derived from a previously-received response from the server. ### Claim 20 A system for authenticating a user of a client device at a server, the method comprising: a memory configured to store information regarding the hardware, software, or network information related to the client device or biometric information related to the user; a processor configured to execute computer instructions for: prompting the user to enter only a subset of characters at a specific position in a username associated with the user; prompting the user to enter only a subset of characters at a specific position in a password or a one-time-use password; collecting information regarding the hardware, software, or network information related to the client device or biometric information related to the user; encrypting data, using a computer microprocessor associated with the client device, with the subset of characters in the username or password, one-time-use password, or collected information; transmitting the encrypted data from the client device to the server via a network link therebetween; decrypting the data, at the server, using a server-side copy of the username, password, and collected information; and when no matching server-side copy of the username, password, and collected information exists, prompting the client for a series of challenge questions or a new client registration process to establish a record on the server of client parameters.