User-centric question and answer for authentication and security

• US 20060288225A1
• Filed: 06/03/2005
• Published: 12/21/2006
• Est. Priority Date: 06/03/2005
• Status: Abandoned Application

• Current Assignee: Searete LLC (Intellectual Ventures LLC)
• Original Assignee: Searete LLC (Intellectual Ventures LLC)
• Inventors: Lord, Robert W., Jung, Edward K.Y., Levien, Royce A., Malamud, Mark A., Rinaldo, John D. Jr.
• Application Number:
  US11/145,547
• Publication Number:
  US 20060288225A1
• Time in Patent Office: Days
• US Class Current: 713/182
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G07C 9/33 by means of a password

Abstract

A system and method for authenticating a user over a voice-based security system, includes but is not limited to posing two or more questions including at least one question independent of security significance; receiving one or more answers to the two or more questions; and if the one or more answers include at least one correct answer to one or more predetermined questions of the two or more questions, the one or more predetermined questions having security significance, allowing an authentication.

Claims

1. A method for authenticating a user over a voice-based system, the method comprising:

posing two or more questions including at least one question relatively independent of security significance;

receiving one or more answers to the two or more questions; and

if the one or more answers include at least one correct answer to one or more predetermined questions of the two or more questions, the one or more predetermined questions having security significance, allowing an authentication.

2. The method of claim 1 further comprising:

receiving a communication request for authentication.

3. The method of claim 1 further comprising:

if the one or more answers include at least one incorrect answer to the one or more predetermined questions of the two or more questions, the one or more predetermined questions having security significance, disallowing an authentication.

4. The method of claim 1 further comprising:

comparing the received one or more answers to a stored list of answers, the stored list of answers enabling a comparison between one or more prior provided answers; and

disallowing an authentication if the one or more answers include one or more substantially similar answers from the one or more prior provided answers to the one or more predetermined questions.

5. The method of claim 1 further comprising:

requiring that the one or more predetermined questions having security significance have one or more predetermined correct answers with one or more conversational qualities.

6. The method of claim 5 wherein the requiring that the one or more predetermined questions having security significance have one or more predetermined correct answers with one or more conversational qualities includes:

applying a rubric to determine conversational qualities of the one or more predetermined correct answers, the conversational qualities including at least one or more of a duration beyond a predetermined time.

7. The method of claim 1 further comprising:

comparing the received one or more answers to a stored list of answers, the stored list of answers providing one or more optional answers to the one or more questions, the one or more optional answers being weighted for correctness; and

determining whether a received answer of the received one or more answers is correct by comparing the one or more optional answers being weighted for correctness to a statistical likelihood of correctness.

8. The method of claim 7 wherein the comparing the received one or more answers to a stored list of answers, the stored list of answers providing one or more optional answers to the one or more questions, the one or more optional answers being weighted for correctness includes:

determining which of the received one or more answers have security significance;

applying a statistical probability density function to the answers having security significance; and

determining the statistical likelihood of correctness according to a statistical probability density function applied to the answers having security significance.

9. The method of claim 2 wherein the receiving a communication request for authentication includes:

receiving the communication request for authentication from a voice-in/voice-out (VIVO) computer over a secure data network.

10. The method of claim 2 wherein the receiving a communication request for authentication includes:

receiving a transmission from a telephone transmitting the request to a network controller.

11. The method of claim 1 wherein the posing two or more questions including at least one question relatively independent of security significance includes:

receiving a user identification; and

connecting to a user-centric list of questions associated with the user identification.

12. The method of claim 1 wherein the posing two or more questions including at least one question relatively independent of security significance includes:

posing one or more questions that are relatively independent of security significance for a first authentication; and

storing the one or more questions for posing of the one or more questions in a second authentication, the one or more questions having more security significance in the second authentication as compared to the first authentication.

13. A computer program product comprising:

a signal bearing medium bearing

one or more instructions for posing two or more questions including at least one question relatively independent of security significance;

one or more instructions for receiving one or more answers to the two or more questions; and

one or more instructions for allowing an authentication if the one or more answers include at least one correct answer to one or more predetermined questions of the two or more questions, the one or more predetermined questions having security significance.

14. The computer program product of claim 13 wherein the signal bearing medium comprises:

a recordable medium.

15. The computer program product of claim 13 wherein the signal bearing medium comprises:

a transmission medium.

16. The computer program product of claim 13 further comprising:

one or more instructions for receiving a communication request for authentication.

17. The computer program product of claim 13 further comprising:

one or more instructions for disallowing an authentication if the one or more answers include at least one incorrect answer to one or more predetermined questions of the two or more questions, the one or more predetermined questions having security significance.

18. The computer program product of claim 13 further comprising:

one or more instructions comparing the received one or more answers to a stored list of answers, the stored list of answers enabling a comparison between one or more prior provided answers; and

one or more instructions disallowing an authentication if the one or more answers include one or more substantially similar answers from the one or more prior provided answers to the one or more predetermined questions.

19. The computer program product of claim 13 further comprising:

one or more instructions for requiring that the one or more predetermined questions having security significance have one or more predetermined correct answers with one or more conversational qualities.

20. The computer program product of claim 19 wherein the one or more instructions for requiring that the one or more predetermined questions having security significance have one or more predetermined correct answers with one or more conversational qualities include:

one or more instructions for applying a rubric to determine conversational qualities of the one or more predetermined correct answers, the conversational qualities including at least one or more of a duration beyond a predetermined time.

21. The computer program product of claim 13 further comprising:

one or more instructions for comparing the received one or more answers to a stored list of answers, the stored list of answers providing one or more optional answers to the one or more questions, the one or more optional answers being weighted for correctness; and

one or more instructions determining whether a received answer of the received one or more answers is correct by comparing the one or more optional answers being weighted for correctness to a statistical likelihood of correctness.

22. The computer program product of claim 21 wherein the

one or more instructions for comparing the received one or more answers to a stored list of answers, the stored list of answers providing one or more optional answers to the one or more questions, the one or more optional answers being weighted for correctness include:

one or more instructions for determining which of the received one or more answers have security significance;

one or more instructions for applying a statistical probability density function to the answers having security significance; and

one or more instructions for determining the statistical likelihood of correctness according to a statistical probability density function applied to the answers having security significance.

23. The computer program product of claim 16 wherein the one or more instructions for receiving a communication request for authentication include one or more instructions for receiving the communication request for authentication from a voice-in/voice-out (VIVO) computer over a secure data network.

24. The computer program product of claim 16 wherein the one or more instructions for receiving a communication request for authentication include:

one or more instructions for receiving a transmission from a telephone transmitting the request to a network controller.

25. The computer program product of claim 13 wherein the one or more instructions for posing two or more questions including at least one question relatively independent of security significance include:

one or more instructions for receiving a user identification; and

one or more instructions for connecting to a user-centric list of questions associated with the user identification.

26. The computer program product of claim 13 wherein the one or more instructions for posing two or more questions including at least one question relatively independent of security significance include:

one or more instructions for posing one or more questions that are relatively independent of security significance for a first authentication; and

one or more instructions for storing the one or more questions for posing of the one or more questions in a second authentication, the one or more questions having more security significance in the second authentication as compared to the first authentication.

27. A communication device comprising:

a processor;

audio input and output circuitry coupled to the processor;

a memory coupled to the processor; and

a security module coupled to the processor, the security module configured to determine whether the processor should implement a secure protocol, the secure protocol configured to implement a user-centric authentication, the security module configured to include

a question module configured to determine two or more questions including at least one question independent of security significance, and

an answer module configured to allow an authentication if one or more answers received include at least one correct answer to one or more predetermined questions of the two or more questions, the one or more predetermined questions having security significance.

28. The communication device of claim 27 wherein the security module is coupled to the processor, located within the processor, and/or located in the memory.

29. The communication device of claim 27 wherein the memory is one or more of random access memory, read only memory, an optical memory, and/or a subscriber identity module memory.

30. The communication device of claim 27 wherein the audio input and output circuitry includes one or more of a microphone, a speaker, a transducer, and/or audio input and output circuitry.

31. The communication device of claim 27 further comprising:

a display coupled to the processor, the display being one or more of a liquid crystal display (LCD), a light emitting diode (LED) display, and/or a plasma display; and

a user interface coupled to the processor, the user interface including one or more of a keypad, one or more buttons, a touch pad, a joystick, and/or a device for providing an interface between a user and an electronic device.

32. The communication device of claim 27 further comprising a housing coupled to the processor, the housing encasing the memory, the processor, and the audio input and output circuitry.

33. A network security system comprising:

a network controller;

a processor coupled to the network controller;

a memory coupled to the processor;

a receiver coupled to the processor; and

a security module coupled to the memory, the security module configured to determine whether the processor should implement a secure protocol, the secure protocol configured to implement a user-centric authentication, the security module configured to include

a question module configured to determine two or more questions including at least one question independent of security significance, and

an answer module configured to allow an authentication if one or more answers received include at least one correct answer to one or more predetermined questions of the two or more questions, the one or more predetermined questions having security significance.

34. The network security system of claim 33 wherein the network controller is a controller for a data network, the data network being one or more of the Internet, an intranet, a local area network (LAN), a wide area network (WAN), a cable network, a telecommunications network, a local telephone network, a long distance telephone network, a cellular telephone network, a satellite communications network, and/or a cable television network.