# US 9,519,764 B2 · Method and system for abstracted and randomized one-time use passwords for transactional authentication > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,519,764 B2 - Document ID: US9519764B2 - Status: Granted - Kind: B2 - Application number: 14/518,893 - Filed: 2014-10-20 - Published: 2015-02-05 - Granted: 2016-12-13 - Earliest claimed: 2010-11-30 - Assignees: Forticode Limited - Applicants: Forticode Limited - Inventors: Antony Smales - Web page: https://patentgrep.com/patent/US9519764B2 ## CPC - G06F 21/31: User authentication - G06F 21/36: by graphic or iconic representation - G06F 21/83: input devices, e.g. keyboards, mice or controllers thereof - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04L 63/0838: {using one-time-passwords} - H04L 9/3271: {using challenge-response} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A security system and method for authenticating a user's access to a target system is disclosed. The security system receives an authentication request from the user and generates a security matrix which comprises a mapping between each symbol within a symbol set and a code value randomly selected from a distinct code set. The number of elements in the symbol set and in the code set are selected to provide a predetermined level of security against capture of a user-defined keyword by an unauthorized observer. The security system sends the security matrix to the user and awaits a one-time code in response. The user forms the one-time code based on the user keyword and the security matrix. The security system validates the one-time code against the security matrix and the keyword to determine an authentication result, permitting or denying the user access to the target system. ## Claims ### Claim 1 A user authentication method comprising execution, by a processing system, of the steps of: receiving a request from a user to initiate an authentication session, the request comprising a unique identifier of the user; accessing, using the unique identifier, a record stored in memory associated with the user, the stored record comprising at least a user-defined keyword consisting of an ordered sequence of symbols comprising members of a predetermined symbol set selected from one or more symbol sets supported by the processing system, wherein the symbols of the ordered sequence have been previously selected by the user independently of other users' selections; generating a one-time security matrix which is valid only for the user during the authentication session, and which comprises a mapping between each symbol within the predetermined symbol set and a code value which is specific to the authentication session and randomly selected from a code set which is distinct from the predetermined symbol set, a number of elements in the predetermined symbol set being greater than a number of elements in the code set, and wherein at least one of the number of elements in the predetermined symbol set and the number of elements in the code set has been selected to provide a predetermined level of security against capture of the user-defined keyword by an unauthorised observer; transmitting the one-time security matrix for presentation to the user; receiving an ordered sequence of code values selected from the one-time security matrix and input by the user, the ordered sequence of code values corresponding with the ordered sequence of symbols of the user-defined keyword and the mapping thereof to the code values in the one-time security matrix; validating the received ordered sequence of code values by comparison with an expected sequence of code values generated by the processing system and corresponding with the ordered sequence of symbols of the user-defined keyword and the mapping thereof to the code values in the one-time security matrix; and generating an authentication result of the authentication session based upon the comparison. ### Claim 2 (depends on 1) The method of claim 1 wherein the number of elements in the predetermined symbol set and the number of elements in the code set are selected such that a ratio between the number of elements in the predetermined symbol set and the number of elements in the code set is between four and seven. ### Claim 3 (depends on 1) The method of claim 1 wherein the number of elements in the code set is between two and 10. ### Claim 4 (depends on 1) The method of claim 1 wherein a length of the user-defined keyword is at least four symbols. ### Claim 5 (depends on 1) The method of claim 1 wherein the number of elements in the code set is at least four, and a length of the user-defined keyword is at least eight symbols. ### Claim 6 (depends on 1) The method of claim 1 wherein the stored record further comprises code value complexity preference data of the user, and wherein: the ordered sequence of code values input by the user, and corresponding with the ordered sequence of symbols of the user-defined keyword and the mapping thereof to the code values in the one-time security matrix, is further based upon the code value complexity preference data; and the expected sequence of code values generated by the processing system, and corresponding with the ordered sequence of symbols of the user-defined keyword and the mapping thereof to the code values in the one-time security matrix, is further based upon the code value complexity preference data. ### Claim 7 (depends on 6) The method of claim 6 wherein the code value complexity preference data of the user comprises user preferences including an offset value, and wherein the step of validating the received ordered sequence of code values comprises generating a corresponding sequence of code values based upon the user-defined keyword in the stored record, the one-time security matrix mapping of symbols to the numerical values of the code set, and calculation of modified code values based upon the offset value. ### Claim 8 (depends on 6) The method of claim 6 wherein the code value complexity preference data of the user comprises user preferences including a crawl value, and wherein the step of validating the received ordered sequence of code values comprises generating a corresponding sequence of code values based upon the user-defined keyword in the stored record, the one-time security matrix mapping of symbols to the numerical values of the code set, and calculation of modified code values based upon the crawl value. ### Claim 9 (depends on 6) The method of claim 6 wherein the code value complexity preference data of the user comprises user preferences including a jump value, and wherein the step of validating the received ordered sequence of code values comprises generating a corresponding sequence of code values based upon the user-defined keyword in the stored record, the one-time security matrix mapping of symbols to the numerical values of the code set, and calculation of modified code values based upon the jump value. ### Claim 10 (depends on 6) The method of claim 6 wherein the code value complexity preference data of the user comprises user preferences including a mask value, and wherein the step of validating the received ordered sequence of code values comprises generating a corresponding sequence of code values based upon the user-defined keyword in the stored record, the one-time security matrix mapping of symbols to the numerical values of the code set, and calculation of modified code values based upon the mask value. ### Claim 11 (depends on 1) The method of claim 1 wherein: the step of receiving the request from the user comprises receiving the request from a secure system distinct from the processing system, the secure system having a corresponding secure system identifier; the request further comprises the secure system identifier; and the step of generating the one-time security matrix is based upon preferences associated with the secure system identifier. ### Claim 12 (depends on 11) The method of claim 11 wherein the step of transmitting the one-time security matrix for presentation to the user comprises: transmitting the one-time security matrix to the secure system; the secure system constructing a custom representation of the one-time security matrix; and the secure system presenting the custom representation of the one-time security matrix to the user. ### Claim 13 (depends on 11) The method of claim 11 wherein the step of generating the one-time security matrix includes randomly selecting code values from a code set determined in accordance with preferences associated with the secure system identifier. ### Claim 14 (depends on 1) The method of claim 1 wherein the stored record further comprises an alternative user-defined keyword of the user consisting of an ordered sequence of symbols selected from the predetermined symbol set, and wherein: the step of validating the received ordered sequence of code values further comprises performing a comparison with an alternative expected sequence of code values generated by the processing system and corresponding with the ordered sequence of symbols of the alternative user-defined keyword and the mapping thereof to the code values in the one-time security matrix; and in the event that the comparison results in a match, generating the authentication result of the authentication session comprising a panic indication. ### Claim 15 A user authentication apparatus comprising: a computer-readable data store containing one or more records, each of which is associated with a user by a unique identifier and comprises at least a user-defined keyword consisting of an ordered sequence of symbols comprising members of a predetermined symbol set selected from one or more symbol sets supported by the user authentication apparatus, wherein the symbols of the ordered sequence have been previously selected by the user independently of other users' selections; and a computer-implemented processor comprising a digital electronic processing unit and associated stored program instructions which, when executed by the processing unit, cause the processing unit to: receive a request from a user to initiate an authentication session, the request comprising the unique identifier associated with the user; access in the data store, using the unique identifier, the stored record associated with the user; generate a one-time security matrix which is valid only for the user during the authentication session, and which comprises a mapping between each symbol within the predetermined symbol set and a code value which is specific to the authentication session and randomly selected from a code set which is distinct from the predetermined symbol set, a number of elements in the predetermined symbol set being greater than a number of elements in the code set, and wherein at least one of the number of elements in the predetermined symbol set and the number of elements in the code set has been selected to provide a predetermined level of security against capture of the user-defined keyword by an unauthorised observer; transmit the one-time security matrix for presentation to the user; receive an ordered sequence of code values selected from the one-time security matrix and input by the user, the ordered sequence of code values corresponding with the ordered sequence of symbols of the user-defined keyword and the mapping thereof to the code values in the one-time security matrix; validate the received ordered sequence of code values by comparison with an expected sequence of code values generated by the processing system and corresponding with the ordered sequence of symbols of the user-defined keyword and the mapping thereof to the code values in the one-time security matrix; and generate an authentication result of the authentication session based upon the comparison. ### Claim 16 (depends on 15) The apparatus of claim 15 wherein the number of elements in the predetermined symbol set and the number of elements in the code set are selected such that a ratio between the number of elements in the predetermined symbol set and the number of elements in the code set is between four and seven. ### Claim 17 (depends on 15) The apparatus of claim 15 wherein the number of elements in the code set is between two and 10. ### Claim 18 (depends on 15) The apparatus of claim 15 wherein a length of the user-defined keyword is at least four symbols. ### Claim 19 (depends on 15) The apparatus of claim 15 wherein the number of elements in the code set is at least four, and a length of the user-defined keyword is at least eight symbols. ### Claim 20 (depends on 15) The apparatus of claim 15 wherein each record associated with a user in the data store further comprises code value complexity preference data of the user, and wherein: the ordered sequence of code values input by the user, and corresponding with the ordered sequence of symbols of the user-defined keyword and the mapping thereof to the code values in the one-time security matrix, is further based upon the code value complexity preference data; and the expected sequence of code values generated by the processing system, and corresponding with the ordered sequence of symbols of the user-defined keyword and the mapping thereof to the code values in the one-time security matrix, is further based upon the code value complexity preference data. ### Claim 21 (depends on 20) The apparatus of claim 20 wherein the code value complexity preference data of the user comprises user preferences including an offset value, and wherein, in validating the received ordered sequence of code values, the program instructions cause the processing unit to generate a corresponding sequence of code values based upon the user-defined keyword in the stored record, the one-time security matrix mapping of symbols to the numerical values of the code set, and calculation of modified code values based upon the offset value. ### Claim 22 (depends on 20) The apparatus of claim 20 wherein the code value complexity preference data of the user comprises user preferences including a crawl value, and wherein, in validating the received ordered sequence of code values, the program instructions cause the processing unit to generate a corresponding sequence of code values based upon the user-defined keyword in the stored record, the one-time security matrix mapping of symbols to the numerical values of the code set, and calculation of modified code values based upon the crawl value. ### Claim 23 (depends on 20) The apparatus of claim 20 wherein the code value complexity preference data of the user comprises user preferences including a jump value, and wherein, in validating the received ordered sequence of code values, the program instructions cause the processing unit to generate a corresponding sequence of code values based upon the user-defined keyword in the stored record, the one-time security matrix mapping of symbols to the numerical values of the code set, and calculation of modified code values based upon the jump value. ### Claim 24 (depends on 20) The apparatus of claim 20 wherein the code value complexity preference data of the user comprises user preferences including a mask value, and wherein, in validating the received ordered sequence of code values, the program instructions cause the processing unit to generate a corresponding sequence of code values based upon the user-defined keyword in the stored record, the one-time security matrix mapping of symbols to the numerical values of the code set, and calculation of modified code values based upon the mask value. ### Claim 25 (depends on 15) A security system comprising: a user-authentication apparatus according to claim 15; and a secure system for which a user having a record within the data store requires authentication, and which is configured to: receive the unique identifier associated with the user; transmit a request to initiate an authentication session to the user-authentication apparatus, the request comprising the unique identifier of the user; receive, from the user-authentication apparatus, the one-time security matrix; present the one-time security matrix to the user; receive, from the user, the ordered sequence of code values selected from the one-time security matrix; transmit the ordered sequence of code values to the user-authentication apparatus; and receive, from the user-authentication apparatus, the authentication result. ### Claim 26 (depends on 25) The security system of claim 25 wherein the secure system comprises one of: a web server interface, wherein input is received from the user and the one-time security matrix is presented to the user via a web browser operated by the user; an automatic teller machine; or a point-of-sale terminal.