Secure Authentication Systems and Methods

Abstract

Systems and methods are provided for authentication by combining a Reverse Turing Test (RTT) with password-based user authentication protocols to provide improved resistance to brute force attacks. In accordance with one embodiment of the invention, a method is provided for user authentication, the method including receiving a username/password pair associated with a user; requesting one or more responses to a first Reverse Turing Test (RTT); and granting access to the user if a valid response to the first RTT is received and the username/password pair is valid.

1 . A method for user authentication, the method comprising:
 receiving a username/password pair associated with a user;   requesting one or more responses to a first Reverse Turing Test (RTT); and   granting access to the user, if a valid response to the first RTT is received and the username/password pair is valid.   
   
   
       2 . The method of  claim 1 , wherein the step of requesting one or more responses comprises:
 checking if an entered username/password pair is valid; and   if the username/password pair is valid, requesting one or more responses based on a first RTT.   
   
   
       3 . The method of  claim 1 , the step of requesting one or more responses comprises:
 checking if an entered username/password pair is valid; and   if the username/password pair is invalid, requesting one or more responses based on a first RTT.   
   
   
       4 . The method of  claim 1 , the step of requesting one or more responses comprises:
 checking if an entered username/password pair is valid; and   if the username/password pair is invalid, not requesting one or more responses based on a first RTT.   
   
   
       5 . The method of  claim 1 , further comprising:
 if an invalid response to the first RTT is received:   requesting one or more responses based on a second RTT; and   denying access to the respondent regardless of whether the one or more responses to the second RTT are valid.   
   
   
       6 . The method of  claim 1 , wherein the first RTT is a deterministic function of the username/password pair. 
   
   
       7 . The method of  claim 1 , wherein the first RTT is a non-deterministic or random function that depends on the username/password pair with a predetermined probability. 
   
   
       8 . A method as in  claim 1 , wherein the first RTT is independent of the username/password pair. 
   
   
       9 . The method of  claim 1 , wherein the type of RTT used is selected from one or more types of RTTs. 
   
   
       10 . The method of  claim 9 , wherein for each type of RTT, the time between receiving a username/password pair and requesting one or more responses to a first RTT is the same. 
   
   
       11 . A method as in  claim 1 , further comprising:
 providing the user with a cookie, wherein the cookie indicates the user provided a valid response to the first RTT.   
   
   
       12 . A method for user authentication, the method comprising:
 sending to a user a request for username/password pair and a request for a response to a Reverse Turing Test (RTT);   receiving a valid response to the RTT from the user; and   authenticating user based on a valid user/password pair.   
   
   
       13 . A method as in  claim 12 , further comprising:
 providing the user with a cookie, wherein the cookie indicates the user correctly answered the RTT.   
   
   
       14 . A method as in  claim 12 , wherein sending to the user comprising:
 checking for a cookie stored on the user computer; and   if the cookie exists, sending to the user a request for username/password pair and not sending the request for a response to the RTT.   
   
   
       15 . A computer program package for user authentication, the computer program package providing instructions, which, if executed by a computer system, cause the system to perform operations comprising:
 receiving a username//password pair associated with a user;   requesting one or more responses to a first Reverse Turing Test (RTT); and   granting access to the user, if a valid response to the first RTT is received and the username/password pair is valid.   
   
   
       16 . A computer program package as in  claim 15 , wherein the step of requesting one or more responses comprises:
 checking if an entered username/password pair is valid; and   if the username/password pair is valid, requesting one or more responses based on a first RTT.   
   
   
       17 . A computer program package as in  claim 15 , wherein the step of requesting one or more responses comprises:
 checking if an entered username/password pair is valid; and   if the username/password pair is invalid, not requesting one or more responses based on a first RTT.   
   
   
       18 . A computer program package as in  claim 15 , the computer program package providing instructions, which, if executed by a computer system, cause the system to perform operations further comprising:
 if an invalid response to the first RTT is received:   requesting one or more responses based on a second RTT; and   denying access to the respondent regardless of whether the one or more responses to the second RTT are valid.   
   
   
       19 . A computer program package as in  claim 15 , wherein the first RTT is a deterministic function of the username/password pair. 
   
   
       20 . A computer program package as in  claim 15 , wherein the first RTT is a non-deterministic or random function that depends on the username/password pair with a predetermined probability. 
   
   
       21 . (canceled)