Taking a picture of a one-time use passcode and using the picture to authenticate

Patent metadata

Field	Value
Publication number	US-9614838-B1
Application number	US-201514662377-A
Country	US
Kind code	B1
Filing date	Mar 19, 2015
Priority date	Mar 19, 2015
Publication date	Apr 4, 2017
Grant date	Apr 4, 2017

Abstract

Techniques involve a user taking a picture of a current one-time use passcode (OTP) and using the picture to authenticate. Such techniques alleviate the burden and frustration of the user having to manually type in the current OTP. Additionally, the user will not trigger a lockout via accidental typing errors. Furthermore, the current OTP can be augmented to include more than a string of six or eight alphanumeric characters for stronger security (e.g., by using non-alphanumeric characters, by capturing multi-digit seven-segment LCD display patterns, by using a QR code, by using a randomly selected image, etc.). One technique involves taking a picture of an OTP provided by a user. The particular technique further involves extracting the OTP from the picture and performing an authentication operation based on the OTP extracted from the picture to determine whether the user is authentic.

First claim

What is claimed is:

1. A computer-implemented method of providing authentication,
the computer-implemented method comprising:
taking, by processing circuitry, a picture of a one-time passcode (OTP) provided by a user;
extracting, by the processing circuitry, the OTP from the picture; and
performing, by the processing circuitry, an authentication operation based on the OTP extracted from the picture to determine whether the user is authentic;

wherein taking the picture of the OTP provided by the user includes:
capturing, by the processing circuitry, an OTP image displayed by an electronic display, the OTP being visually discernable in the captured OTP image;

wherein performing the authentication operation includes:
matching, by the processing circuitry, the OTP that is visually discernable in the captured OTP image to an expected OTP to determine whether the user is authentic;

wherein the electronic display is a display screen of a token apparatus;
wherein capturing the OTP image includes:
acquiring a digital photo of the display screen of the token apparatus while the display screen of the token apparatus electronically displays the OTP;

wherein extracting the OTP from the picture includes:
performing a set of operations on the digital photo of the display screen to extract, as the OTP, a recognized series of OTP digits; and

wherein performing the authentication operation based on the OTP extracted from the picture to determine whether the user is authentic further includes:
providing the recognized series of OTP digits to an authentication server which compares the recognized series of OTP digits to an expected series of OTP digits; and
receiving an authentication result from the authentication server indicating whether the recognized series of OTP digits matched the expected series of OTP digits.

2. The computer-implemented method as in claim 1 wherein performing the set of operations on the digital photo of the display screen includes performing a set of optical character recognition (OCR) operations on the digital photo of the display screen.

3. The computer-implemented method as in claim 1 wherein the token apparatus is a hand-held hardware authentication token having, as the display screen, a multi-segment liquid-crystal display (LCD) screen; and
wherein acquiring the digital photo includes using a digital camera to electronically generate a two-dimensional pixelated image of the multi-segment LCD screen of the hand-held hardware authentication token while the user holds the multi-segment LCD screen of the hand-held hardware authentication token in front of a lens of the digital camera.

4. The computer-implemented method as in claim 3 wherein the digital camera is embedded within a smart mobile device; and
wherein acquiring the digital photo further includes storing the two-dimensional pixelated image in an image file within the smart mobile device.

5. The computer-implemented method as in claim 1 wherein the token apparatus is a smart mobile device running a soft token application; and
wherein acquiring the digital photo includes using a digital camera to electronically acquire a two-dimensional pixelated image of a touch screen of the smart mobile device while the user holds the touch screen of the smart mobile device in front of a lens of the digital camera.

6. The computer-implemented method as in claim 5 wherein the digital camera is coupled to a desktop computer; and
wherein acquiring the digital photo further includes storing the two-dimensional pixelated image in an image file within the desktop computer.

7. The computer-implemented method as in claim 1 wherein the processing circuitry includes an interface screen and a digital camera; and wherein the method further comprises:
prior to acquiring the digital photo, providing a set of instructions on the interface screen to direct the user to visually display the OTP to the digital camera.

8. The computer-implemented method as in claim 7 , further comprising:
prior to extracting the OTP, displaying the digital photo on the interface screen and prompting the user for a command to submit the digital photo for authentication processing.

9. The computer-implemented method as in claim 1
wherein the processing circuitry includes local circuitry residing in a user device
and remote circuitry residing in the authentication server; and
wherein providing the recognized series of OTP digits to the authentication server includes:
conveying, as the picture, an image file from the local circuitry residing in the user device to the remote circuitry residing in the authentication server over a computer network.

10. The computer-implemented method as in claim 1
wherein the processing circuitry that captures the OTP image forms part of a smart device;
wherein the token apparatus is a dedicated authentication token device and has a handheld form factor;
wherein the user provides the OTP by maneuvering the handheld form factor of the dedicated authentication token device in front of a camera of the smart device while the display screen of the dedicated authentication token device displays the OTP; and
wherein acquiring a digital photo of the display screen of the token apparatus while the display screen of the token apparatus electronically displays the OTP includes operating the camera of the smart device to obtain a view of the display screen of the dedicated authentication token device while the display screen of the dedicated authentication token device displays the OTP.

11. An electronic apparatus, comprising:
a digital camera;
memory; and
control circuitry coupled to the digital camera and the memory, the memory storing instructions which, when carried out by the control circuitry, cause the control circuitry to:
take a picture of a one-time passcode (OTP) provided by a user using the digital camera,
extract the OTP from the picture, and
perform an authentication operation based on the OTP extracted from the picture to determine whether the user is authentic;

wherein the control circuitry, when taking the picture of the OTP provided by the user, is constructed and arranged to:
capture an OTP image displayed by an electronic display, the OTP being visually discernable in the captured OTP image; and

wherein the control circuitry, when performing the authentication operation, is constructed and arranged to:
match the OTP that is visually discernable in the captured OTP image to an expected OTP to determine whether the user is authentic

wherein the electronic display is a display screen of a token apparatus;
wherein the control circuitry, when taking the picture of the OTP provided by the user, is constructed and arranged to:
acquire a digital photo of the display screen of the token apparatus while the display screen of the token apparatus electronically displays the OTP;

wherein the control circuitry, when extracting the OTP from the picture, is constructed and arranged to:
perform a set of operations on the digital photo of the display screen of the token apparatus to extract, as the OTP, a recognized series of OTP digits; and

wherein the control circuitry, when performing the authentication operation based on the OTP extracted from the picture to determine whether the user is authentic, is constructed and arranged to:
provide the recognized series of OTP digits to an authentication server which compares the recognized series of OTP digits to an expected series of OTP digits, and
receive an authentication result from the authentication server indicating whether the recognized series of OTP digits matched the expected series of OTP digits.

Assignees

• Emc Corp
• Emc Ip Holding Co Llc

Inventors

• Duchin Zohar
• Blatt Marcelo
• Zaslavsky Alex
• Liptz Liron

Classifications

• H04L9/3228

  One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key · CPC title

• H04L63/0838 Primary

  using one-time-passwords · CPC title

• H04W12/06

  Authentication · CPC title

• G06F21/33

  using certificates · CPC title

• G06F21/32

  using biometric data, e.g. fingerprints, iris scans or voiceprints · CPC title