Artificial intelligence encryption model (aiem) with device authorization and attack detection (daaad)

Abstract

A user of a client device establishes a secure connection to a server (or other) device without using public keys or third-party certification by entering only a subset of characters in a username associated with the user and a one-time-use password at the client device; an application on the client device collects information regarding the hardware, software, or network information related to the client device or biometric information related to the user. Data sent between the client and server is encrypted (and thereafter transmitted) using, the subset of characters, one-time-use password, and collected information. Communications between the client and server may be monitored to detect a man-in-the-middle attacker, and a security strength may be varied accordingly.

What is claimed is: 
     
         1 - 20 . (canceled) 
     
     
         21 . A method for authenticating a user of a client device at a server, while protecting against a man-in-the-middle third party attack, the method comprising:
 immediately testing a network transmission pathway one or more times to determine a transmission latency delay;   determining that an unauthorized man-in-the-middle third party attack is possibly occurring due to a test yielding an unexpected result;   confirming, based on a determination that the transmission time is greater than an allowed latency threshold, that either:
 a corrupt, dysfunctional, or inadequate transmission path is present; or 
 an unauthorized man-in-the-middle third party attack is definitely occurring; 
   causing the client device, the server, and the man-in-the-middle third party, to perform time-consuming calculations that require each CPU to work for a minimum amount of time that is at least greater and longer than an expected average time, or a standard deviation or a maximum latency round-trip time, to produce expected products from the time-consuming calculations;   using the Merkle tree directly as operands or to modify the operands, the operands being used to produce keys during the session, the keys being used to encrypt and decrypt data sent between the client device and the server;   when the client device or the server performs the time-consuming calculations and replies, without a man-in-the-middle third party present, the transmission latency is within the allowed latency threshold, and   when the client device or the server performs the calculations and replies, and a man-in-the-middle third party passively intercepts the reply and makes no attempt to modify the data, a Diffie-Hellman key exchange becomes immune to the attack, and, when appropriately large operands are used, the Diffie-Hellman key exchange consistently produces a key known only to the client device and the server, and   when the client device or the server performs the time-consuming calculations and replies, and a man-in-the-middle third party actively intercepts the transmission and attempts to modify the transmission by performing an attack by recalculating a product of the transmission, then, due to the complexity of the time-consuming calculations, a latency time caused by the complexity of the time-consuming calculations by the man-in-the-middle third party that are added to the latency time created by the client device or the server, plus the latency time of the transmission, causes a total latency time delay to be outside of the allowed latency threshold to indicate that a man-in-the-middle third party is present;   encrypting data, using a processor associated with the client device and collected client device or user information;   transmitting the encrypted data from the client device to the server via a network link therebetween;   decrypting the data, at the server, using a server-side copy of two or more of: a username, a password, a challenge question, and the collected information.   
     
     
         22 . The method of  claim 21 , wherein the man-in-the-middle third party attack is an Oracle or Spoiler attack. 
     
     
         23 . The method of  claim 21 , wherein the network transmission pathway is tested by transmitting randomly-generated bytes of data. 
     
     
         24 . The method of  claim 21 , wherein the network transmission pathway is tested by transmitting data packets that are generated using operands derived from a Merkle tree. 
     
     
         25 . The method of  claim 24 , wherein the Merkle tree is generated based on one or more tests performed by the client device, the one or more tests comprising determining one or more of:
 clock pulse data;   a page load speed;   a transmission latency test;   a biometric characteristic of a user;   a biometric response time to stimulus of the user;   a device test of the client device; and   a script or software math capability.   
     
     
         26 . The method of  claim 25 , wherein the transmission latency test comprises determining one or more of: a minimum, a maximum, a mean, a median, an average, a standard deviation, and other measurable characteristic variances. 
     
     
         27 . The method of  claim 25 , wherein the biometric characteristic of the user comprises one or more of: a fingerprint, a retina scan, and a voice print. 
     
     
         28 . The method of  claim 25 , wherein the biometric response time to stimulus of the user comprises one or more of: a request to click a button, a time to respond to a captcha code, an ID prompt, a password prompt, and selecting a personal photograph. 
     
     
         29 . The method of  claim 25 , wherein the device test of the client device comprises determining one or more of: a CPU math capacity to determine a number of calculations performed within a given time, installed fonts, screen size, BIOS (basic input/output system), browser information, geo-location, and firmware configuration. 
     
     
         30 . The method of  claim 25 , wherein the script or software math capability comprises an ability to utilize large prime numbers to perform Diffie-Hellman calculations. 
     
     
         31 . The method of  claim 21 , wherein the unexpected result comprises one or more of: a user not selecting a correct image, a user having an unrecognized physical feature, and a device configuration or CPU capacity not being recognized. 
     
     
         32 . The method of  claim 21 , wherein the time-consuming calculations include calculating one or more of: Diffie-Hellman Prime numbers, secret exponents, secret bases, products used to create hashes for a Merkle tree, and products used to create keys for encrypting data. 
     
     
         33 . The method of  claim 21 , wherein, during an initial login from the client device, a password is transmitted to the server using a strong encryption key. 
     
     
         34 . The method of  claim 21 , wherein the transmitting the encrypted data comprises:
 sending a plurality of messages from the client to the server; and   receiving, in response to each of the plurality of messages, a response from the server to the client,   wherein at least one of the plurality of messages sent from the client to the server comprises information derived from a previously-received response from the server.   
     
     
         35 . The method of  claim 21 , further comprising prompting the user for an answer to a challenge question in response to a determination that:
 a subset of characters in a username does not match a username reference value; or   a one-time-use password does not match a password reference value.   
     
     
         36 . The method of  claim 21 , further comprising prompting the user for an answer to a challenge question in response to a determination that a processing ability of the client device is below a processing ability threshold. 
     
     
         37 . The method of  claim 21 , wherein the encrypting comprises determining a strength of encrypting based on a processing ability of the client device. 
     
     
         38 . The method of  claim 21 , further comprising downloading, from the server to the client device, a software application for collecting the information. 
     
     
         39 . The method of  claim 38 , wherein the software application is selected from a pool of candidate software applications. 
     
     
         40 . The method of  claim 38 , wherein the server periodically or randomly varies the software application downloaded to the client device. 
     
     
         41 . A method for authenticating a user of a client device at a server, the method comprising:
 prompting the user to enter partial primary credentials by entering only a subset of characters of primary credentials of the user, the primary credentials including at least one of: a username, an email address, and a password, the subset of characters of primary credentials being a portion, less than the entirety, of the credentials, the credentials being pre-stored at both the client device and the server;   prompting the user to enter a temporary two-factor authentication code;   at a client device, encrypting data using the partial primary credentials and the temporary two-factor authentication code; and   at a server, decrypting the data.   
     
     
         42 . A method for authenticating a user of a client device at a server, while protecting against a brute force attack on a key, the method comprising:
 generating the key to be one or more of:
 of a length that automatically grows longer as CPU capacity improves, and; 
 of a minimum length set by an administrator; and 
 modified according to one or more of: a time stamp, a Merkle tree operand, a blockchain of prior transmission or client device test data, a transmission time, and a user activity, to produce operands that modify the length and content of the key, a hash, and a signature used between the client device and the server; and 
   using the key to encrypt and decrypt data between the client device and the server.   
     
     
         43 . The method of  claim 42 , wherein the key is a 2,048 bit key. 
     
     
         44 . The method of  claim 42 , wherein the encrypting further comprises increasing a strength of the encrypting in response to a determination that the man-in-the-middle is present. 
     
     
         45 . A method for authenticating a user of a client device at a server, the method comprising:
 prompting the user to enter only a subset of username characters from a specific position in a username of the user, the subset of username characters being a portion, less than the entirety, of the username, the username being pre-stored at both the client device and the server;   prompting the user to enter only a subset of characters from a specific position in a password or a one-time-use password, the subset of password characters being a portion, less than the entirety, of the password or one-time-use password, the password or one-time-use password being pre-stored at both the client device and the server;   collecting client-side information regarding the hardware, software, or network information related to the client device and biometric information related to the user, the client-side information comprising a transmission latency between the client and server or a transmission latency of a peer-to-peer network;   encrypting data, using a computer microprocessor associated with the client device, with the subset of characters in the username or password, one-time-use password, or a key based on the collected client-side information, including a key exchange comprising a Diffie-Hellman process;   transmitting the encrypted data from the client device to the server via a network link therebetween, while flagging or disrupting communications if any hash, Merkle tree, or network latency is outside of an expected parameter;   decrypting the data, at the server, using a server-side copy of the username, password, and collected client-side information.   
     
     
         46 . The method of  claim 45 , further comprising prompting the user to enter a temporary two-factor authentication code. 
     
     
         47 . The method of  claim 45 , further comprising:
 testing a transmission time between the client device and the server for a time greater than an allowed threshold associated with a normal transmission time; and   determining that a man-in-the-middle attack is occurring if the time is greater than the allowed threshold.   
     
     
         48 . The system of  claim 47 , wherein the encrypting further comprises increasing a strength of the encrypting in response to the determined attack. 
     
     
         49 . The system of  claim 45 , wherein the transmitting comprises:
 sending a plurality of messages from the client to the server; and   receiving, in response to each of the plurality of messages, a response from the server to the client,   wherein at least one of the plurality of messages sent from the client to the server comprises information derived from a previously-received response from the server.   
     
     
         50 . The system of  claim 45 , further comprising prompting the user for an answer to a challenge question in response to a determination that:
 the subset of characters in the username does not match a username reference value; or   the one-time-use password does not match a password reference value.   
     
     
         51 . The system of  claim 45 , further comprising prompting the user for an answer to a challenge question in response to a determination that a processing ability of the client device is below a processing ability threshold. 
     
     
         52 . The system of  claim 45 , wherein the encrypting comprises determining a strength of encrypting based on a processing ability of the client device.