Method and apparatus for selecting a password

• US 20050044425A1
• Filed: 10/29/2002
• Published: 02/24/2005
• Est. Priority Date: 10/30/2001
• Status: Active Grant

• Current Assignee: F-Secure Corporation (F-Secure Oyj)
• Original Assignee: F-Secure Oyj
• Inventors: Hypponen, Ari
• Granted Patent: US 8,127,141 B2
• Time in Patent Office: Days
• US Class Current: 726/19
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 21/46 by designing passwords or checking the strength of passwords
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G07C 9/33 by means of a password
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

A method of generating or entering a password or passphrase on a computer system 1. The method comprises storing a plurality of sets of values in a memory 5 of the system 1, the values of each set defining respective elements which belong to a common domain, the domains of respective sets being distinct from one another, selecting at least one value from each stored set or from each of a plurality of the stored sets, and combining the selected values or elements thereof to form a password or passphrase.

Claims

1. A method of securing data stored on a computer system, the method comprising:

generating a password comprising a plurality of values;

securing data stored on the system using said password;

implementing a two level authorisation procedure, a first authorisation level requiring input into the system of only a subset of said plurality of values and a second level requiring input of the entire password.

2. A method according to claim 1, wherein each time said first authorisation level is implemented, it requires the input of a subset of values different from that subset required for the preceding implementation.

3. A method according to claim 2, wherein the subset of values required for each implementation of the first authorisation level is selected from the complete set of values on a round robin basis.

4. A method according to claim 1, wherein said step of generating a password comprises selecting a value from each of a plurality of value categories, each value category comprising a multiplicity of values.

5. A method according to claim 4, wherein, when said first authentication level is implemented, an icon grid is displayed for the value category corresponding to each value of the chosen subset of values, the user selecting a value from each icon grid.

6. A method according to claim 5, wherein each icon grid displays icons corresponding to a subset of the values contained in a value category.

7. A method according to claim 4, wherein, when said second authorisation level is implemented, a textual list of the values contained in a value category is displayed for each category, and the user selects a value from each list.

8. A computer system comprising:

first processing means for generating a password comprising a plurality of values and for securing data stored on the system using said password; and

second processing means implementing a two level authorisation procedure, a first authorisation level requiring input into the system of only a subset of said plurality of values and a second level requiring input of the entire password.

9. A computer storage medium having stored thereon a computer program for causing a computer system to:

generate a password comprising a plurality of values;

secure data stored on the system using said password; and

implement a two level authorisation procedure, a first authorisation level requiring input into the system of only a subset of said plurality of values and a second level requiring input of the entire password.

10. A method of generating or entering a password or passphrase or encryption key on a computer system, the method comprising:

storing a plurality of sets of values in a memory of the system, the values of each set defining respective elements which belong to a common domain, the domains of respective sets being distinct from one another;

selecting at least one value from each stored set or from each of a plurality of the stored sets; and

combining the selected values or components thereof to form a password, passphrase, or encryption key.

11. A method according to claim 10, wherein said step of selecting at least one value comprises displaying on the computer system the values of each set and allowing a user to select one value from each set.

12. A method according to claim 11, wherein said step of enabling a user to select at least one value from each stored set comprises displaying on a display of the computer system a graphical user interface.

13. A method according to claim 12, wherein the interface comprises a graphically displayed slider, list, matrix, thumb wheel or the like, which can be operated by the user to scroll through the values of each domain in order to select a value for that domain.

14. A method according to claim 13, wherein, for each position of the slider, wheel or the like, the element corresponding to the value of that position is displayed to provide visual feedback to the user.

15. A method according to claim 14, wherein, after selection of a value for a given domain by the user, the value or mapped element is hidden from view.

16. A method according to claim 13, wherein the display of the system is a touch sensitive display, and the graphical interface is operated by a pen, stylus, or the like.

17. A method according to claim 11, wherein a set of sliders are displayed on a display of the system, one slider corresponding to each domain, and the user is prompted to select a value from each domain in turn, using the corresponding slider.

18. A method according to claim 11, wherein the values of each domain are arranged in a predefined order.

19. A method according to claim 11, wherein, when employed to generate a password or passphrase, the method allows the user to select which of the plurality of sets of values shall be used to generate the password or passphrase, and the order of the selected sets.

20. A method according to claim 10, wherein said step of selecting at least one value is performed by the computer system, the selection being a random selection from the values of the set.

21. A method according to claim 20, and comprising displaying the selected password to the user on a display of the computer system.

22. A computer system comprising:

a memory storing a plurality of sets of values, the values of each set defining respective elements which belong to a common domain, the domains of respective sets being distinct from one another;

a user interface; and

processing means for enabling the selection of at least one value from each stored set or from each of a plurality of the stored sets, and for combining the selected values or elements thereof to form a password, passphrase, or encryption key.

23. A computer storage medium having stored thereon a computer program for causing a computer system to:

store a plurality of sets of values in a memory of the system, the values of each set defining respective elements which belong to a common domain, the domains of respective sets being distinct from one another;

enable the selection of at least one value from each stored set or from each of a plurality of the stored sets; and

concatenate the selected values or elements thereof to form a password, passphrase, or encryption key.