# US 8,789,154 B2 · Anti-shoulder surfing authentication method > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,789,154 B2 - Document ID: US8789154B2 - Status: Granted - Kind: B2 - Application number: 13/174,558 - Filed: 2011-06-30 - Published: 2013-01-03 - Granted: 2014-07-22 - Earliest claimed: 2011-06-30 - Assignees: QUALCOMM Incorporated - Applicants: Qing Li - Inventors: Qing Li - Web page: https://patentgrep.com/patent/US8789154B2 ## CPC - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04L 2463/081: applying self-generating credentials, e.g. instead of receiving credentials from an authority or from another peer, the credentials are generated at the entity itself - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Disclosed is a client device that includes: a user interface to receive a username and a first password associated with a server site visited by a user; a random number generator to generate a random number; and a processor to generate a second password by implementing a function based upon the first password and the random number and to command storage of the random number, the username, and the associated server site. If the user attempts to log onto the server site by inputting their username and the second password, the processor extracts the random number associated with the username and the server site and implements the function based upon the second password and the random number to generate the first password which replaces the second password entered by the user and is submitted to the server site. ## Claims ### Claim 1 A client device comprising: a storage device; a user interface to receive a username and a first password associated with a server site visited by a user; a random number generator to generate a random number; and a processor to: generate a second password by implementing a function based upon the first password and the random number; and command storage of the random number, the username, and the associated server site to the storage device, wherein the first password and the second password are not stored at the client device; wherein, when the user attempts to log onto the server site by inputting their username and the second password, the processor is further configured to extract the random number associated with the username and the server site from the storage device, and implement an inverse of the function based upon the second password and the random number to generate the first password which replaces the second password entered by the user and is submitted to the server site. ### Claim 2 (depends on 1) The client device of claim 1, wherein the function is a one to one mapping function. ### Claim 3 (depends on 1) The client device of claim 1, wherein the function is a block cipher algorithm. ### Claim 4 (depends on 3) The client device of claim 3, wherein the block cipher algorithm is an advanced encryption standard (AES) symmetric-key encryption operation, wherein the second password is outputted from the symmetric-key encryption operation using the random number as a key and the first password. ### Claim 5 (depends on 4) The client device of claim 4, wherein, using a symmetric-key decryption operation with the random number as the key and the second password results in the first password as the output. ### Claim 6 (depends on 1) The client device of claim 1, wherein the user selects one of a normal mode or a protected mode, wherein, in the normal mode, the first password associated with the server site visited by the user is inputted by the user, whereas, in the protected mode, the second password associated with the server site visited by the user is inputted by the user. ### Claim 7 (depends on 1) The client device of claim 1, wherein the server site visited by the user is a web site over the Internet. ### Claim 8 A method to create a second password for a client device comprising: receiving a username and a first password associated with a server site visited by a user; generating a random number utilizing a random number generator of the client device; generating a second password by implementing a function based upon the first password and the random number utilizing a processor of the client device; and commanding storage of the random number, the username, and the associated server site, wherein the first password and the second password are not stored at the client device; wherein, when the user attempts to log onto the server site by inputting their username and the second password, the random number associated with the username and the server site is extracted from storage and an inverse of the function is implemented based upon the second password and the random number to generate the first password which replaces the second password entered by the user and is submitted to the server site. ### Claim 9 (depends on 8) The method of claim 8, wherein the function is a one to one mapping function. ### Claim 10 (depends on 8) The method of claim 8, wherein the function is a block cipher algorithm. ### Claim 11 (depends on 10) The method of claim 10, wherein the block cipher algorithm is an advanced encryption standard (AES) symmetric-key encryption operation, wherein the second password is outputted from the symmetric-key encryption operation using the random number as a key and the first password. ### Claim 12 (depends on 11) The method of claim 11, wherein, using a symmetric-key decryption operation with the random number as the key and the second password results in the first password as the output. ### Claim 13 (depends on 8) The method of claim 8, wherein the user selects one of a normal mode or a protected mode, wherein, in the normal mode, the first password associated with the server site visited by the user is inputted by the user, whereas, in the protected mode, the second password associated with the server site visited by the user is inputted by the user. ### Claim 14 (depends on 8) The method of claim 8, wherein the server site visited by the user is a web site over the Internet. ### Claim 15 A client device comprising: means for receiving a username and a first password associated with a server site visited by a user; means for generating a random number; means for generating a second password by implementing a function based upon the first password and the random number; and means for commanding storage of the random number, the username, and the associated server site, wherein the first password and the second password are not stored at the client device; wherein, when the user attempts to log onto the server site by inputting their username and the second password, the random number associated with the username and the server site is extracted from storage and an inverse of the function is implemented based upon the second password and the random number to generate the first password which replaces the second password entered by the user and is submitted to the server site. ### Claim 16 (depends on 15) The client device of claim 15, wherein the function is a one to one mapping function. ### Claim 17 (depends on 15) The client device of claim 15, wherein the function is a block cipher algorithm. ### Claim 18 (depends on 17) The client device of claim 17, wherein the block cipher algorithm is an advanced encryption standard (AES) symmetric-key encryption operation, wherein the second password is outputted from the symmetric-key encryption operation using the random number as a key and the first password. ### Claim 19 (depends on 18) The client device of claim 18, wherein, using a symmetric-key decryption operation with the random number as the key and the second password results in the first password as the output. ### Claim 20 (depends on 15) The client device of claim 15, wherein the user selects one of a normal mode or a protected mode, wherein, in the normal mode, the first password associated with the server site visited by the user is inputted by the user, whereas, in the protected mode, the second password associated with the server site visited by the user is inputted by the user. ### Claim 21 (depends on 15) The client device of claim 15, wherein the server site visited by the user is a web site over the Internet. ### Claim 22 A computer program product to create a second password for a client device comprising: a non-transitory computer-readable medium comprising code for: receiving a username and a first password associated with a server site visited by a user; generating a random number; generating a second password by implementing a function based upon the first password and the random number; and commanding storage of the random number, the username, and the associated server site, wherein the first password and the second password are not stored at the client device; wherein, when the user attempts to log onto the server site by inputting their username and the second password, the random number associated with the username and the server site is extracted from storage and an inverse of the function is implemented based upon the second password and the random number to generate the first password which replaces the second password entered by the user and is submitted to the server site. ### Claim 23 (depends on 22) The computer program product of claim 22, wherein the function is a one to one mapping function. ### Claim 24 (depends on 22) The computer program product of claim 22, wherein the function is a block cipher algorithm. ### Claim 25 (depends on 24) The computer program product of claim 24, wherein the block cipher algorithm is an advanced encryption standard (AES) symmetric-key encryption operation, wherein the second password is outputted from the symmetric-key encryption operation using the random number as a key and the first password. ### Claim 26 (depends on 25) The computer program product of claim 25, wherein, using a symmetric-key decryption operation with the random number as the key and the second password results in the first password as the output. ### Claim 27 (depends on 22) The computer program product of claim 22, wherein the user selects one of a normal mode or a protected mode, wherein, in the normal mode, the first password associated with the server site visited by the user is inputted by the user, whereas, in the protected mode, the second password associated with the server site visited by the user is inputted by the user. ### Claim 28 (depends on 22) The computer program product of claim 22, wherein the server site visited by the user is a web site over the Internet.