System, device, and method of generating and utilizing one-time passwords

Patent metadata

Field	Value
Publication number	US-11606353-B2
Application number	US-202117382388-A
Country	US
Kind code	B2
Filing date	Jul 22, 2021
Priority date	Jul 22, 2021
Publication date	Mar 14, 2023
Grant date	Mar 14, 2023

Abstract

System, device, and method of generating and utilizing one-time passwords. A method generates a particular One-Time Password (OTP) string that is based on pre-defined OTP string construction rules. The particular OTP string is not a purely-random string; rather, the particular non-purely-random OTP string provides to a behavioral monitoring unit a capability to extract user-specific behavioral typing patterns from a way in which a user types characters of the particular OTP via a keyboard of an electronic device. The method sends the particular OTP string to the user; monitors the way that the user types the OTP string; extracts from the user interactions, that were performed while the user entered the OTP string, a user-specific behavioral typing characteristic; and based on that user-specific characteristic, determines whether that user is authenticated or non-authenticated, and optionally activates fraud mitigation operations or transaction blocking operations if the user is non-authenticated.

First claim

What is claimed is:

1. A method comprising:
(a) generating a particular one-time password (OTP) string that is based on one or more pre-defined OTP string construction rules,
wherein the particular OTP string is not a purely-random string,
wherein the particular OTP string provides to a behavioral monitoring unit a capability to extract user-specific behavioral typing patterns from a way in which a user types characters of said particular OTP via a keyboard of an electronic device;
(b) sending said particular OTP string to a message-receiving device of said user, via an electronic message selected from the group consisting of: an electronic mail (email) message, a Short Message Service (SMS) text message;
(c) monitoring user interactions of said user on said electronic device while said user enters data in response to a request to enter said particular OTP string;
(d) extracting from said user interactions, that were performed while said user entered data in response to the request to enter said particular OTP string, a user-specific behavioral characteristic;
(e) based on said user-specific behavioral characteristic, determining whether said user is authenticated or non-authenticated;
wherein the determining of step (e) comprises:
determining whether said user is authenticated or non-authenticated, based on whether (I) a freshly-calculated value of said user-specific behavioral characteristic, that was derived from the way in which said user entered said particular OTP string, matches (II) a class-wide reference value that had previously been calculated for a group of users based on data entry previously performed by said user, wherein said group of users includes said user.

2. The method of claim 1 ,
wherein the determining of step (e) comprises:
determining whether said user is authenticated or non-authenticated, based on whether (I) a freshly-calculated value of said user-specific behavioral characteristic, that was derived from the way in which said user entered said particular OTP string, matches (II) a user-specific reference value that had previously been calculated for said user based on previous data entry of said user.

3. The A method comprising: of claim 1 ,
(a) generating a particular one-time password (OTP) string that is based on one or more pre-defined OTP string construction rules,
wherein the particular OTP string is not a purely-random string,
wherein the particular OTP string provides to a behavioral monitoring unit a capability to extract user-specific behavioral typing patterns from a way in which a user types characters of said particular OTP via a keyboard of an electronic device;
(b) sending said particular OTP string to a message-receiving device of said user, via an electronic message selected from the group consisting of: an electronic mail (email) message, a Short Message Service (SMS) text message;
(c) monitoring user interactions of said user on said electronic device while said user enters data in response to a request to enter said particular OTP string;
(d) extracting from said user interactions, that were performed while said user entered data in response to the request to enter said particular OTP string, a user-specific behavioral characteristic;
(e) based on said user-specific behavioral characteristic, determining whether said user is authenticated or non-authenticated;
wherein the determining of step (e) comprises:
determining whether said user is authenticated or non-authenticated, based on whether (I) a freshly-calculated value of said user-specific behavioral characteristic, that was derived from the way in which said user entered said particular OTP string, matches (II) a class-wide reference value that had previously been calculated for a group of users based on data entry previously performed by said user, wherein said group of users excludes said user.

4. The method of claim 1 ,
wherein the determining of step (e) comprises:
determining whether said user is authenticated or non-authenticated,
based cumulatively on:
(e1) whether (I) a freshly-calculated value of said user-specific behavioral characteristic, that was derived from the way in which said user entered said particular OTP string, matches (II) a previously-calculated reference value that had previously been calculated;
and also,
(e2) based on whether a fresh string that was entered by said user in response to the request to enter said particular OTP string, is identical to said particular OTP string.

5. The method of claim 1 ,
wherein step (e) comprises:
determining that said user is non-authenticated, even though the user entered correctly said particular OTP string in response to the request to enter said particular OTP string, based on a determination that a behavioral typing manner that was exhibited by the user during entry of the particular OTP string differs from a previously-detected behavioral typing manner that was previously determined with regard to said user.

6. The method of claim 1 ,
wherein the generating of step (a) comprises:
pseudo-randomly selecting an OTP string from a pre-defined list of pre-approved OTP strings,
wherein each pre-approved OTP string in said list is an OTP string that is pre-determined as being capable of providing capability to extract user-specific behavioral typing patterns from the way in which users type characters of said pre-approved OTP string.

7. The method of claim 1 ,
wherein generating said particular OTP string comprises: intentionally and deterministically generating an OTP string that includes at least two consecutive characters that are identical to each other.

8. The method of claim 1 ,
wherein generating said particular OTP string comprises: intentionally and deterministically generating an OTP string that includes at least two consecutive characters that are a same alphabetic letter repeated two or more times.

9. The method of claim 1 ,
wherein generating said particular OTP string comprises: intentionally and deterministically generating an OTP string that includes at least two consecutive characters that are a same alphabetic digit repeated two or more times.

10. The method of claim 1 ,
wherein generating said particular OTP string comprises: intentionally and deterministically generating an OTP string that includes, anywhere in said OTP string, a substring of three characters that consists of a first digit, a second digit, and a third digit;
wherein a numerical difference between the first digit and the second digit, is equal to a numerical difference between the second digit and the third digit.

11. The method of claim 1 ,
wherein generating said particular OTP string comprises: intentionally and deterministically generating an OTP string that includes, anywhere in said OTP string, an entire word that appears in a pre-defined list of English words.

12. The method of claim 1 , comprising:
determining which natural language is utilized by said user to interact with a particular computerized service;
wherein generating said particular OTP string comprises: intentionally and deterministically generating an OTP string that includes, anywhere in said OTP string, an entire word that appears in a pre-defined list of words in said natural language.

13. A method comprising:
(a) generating a particular one-time password (OTP) string that is based on one or more pre-defined OTP string construction rules,
wherein the particular OTP string is not a purely-random string,
wherein the particular OTP string provides to a behavioral monitoring unit a capability to extract user-specific behavioral typing patterns from a way in which a user types char

Assignees

• Biocatch Ltd

Inventors

• Zaloum Alexander Basil
• Novik Alesis
• Turgeman Avi

Classifications

• G06F21/46

  by designing passwords or checking the strength of passwords · CPC title

• G06F21/316

  by observing the pattern of computer usage, e.g. typical user behaviour · CPC title

• H04L51/42

  Mailbox-related aspects, e.g. synchronisation of mailboxes · CPC title

• H04L63/0838 Primary

  using one-time-passwords · CPC title

• H04L51/58

  Message adaptation for wireless communication · CPC title