System and method for personalized security signature

• US 20080209526A1
• Filed: 12/11/2007
• Published: 08/28/2008
• Est. Priority Date: 12/11/2006
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Durai, Don Bosco, Varghese, Thomas Emmanual, Fisher, Jon Bryan, Kothanath, Arun, Wong, Sirena
• Granted Patent: US 9,106,422 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861

Abstract

Embodiments of the present invention provide techniques for authenticating users based on personalized (i.e., user-provided) authentication data. In one set of embodiments, the personalized authentication data includes acoustic, image, and/or video data, but is exclusive of biometric data of the user. In this manner, existing acoustic, image, and video-based authentication interfaces/mechanisms may be leveraged, without the problems associated with verifying biometric data. In some embodiments, a user may enroll or register multiple pieces of personalized authentication data into an authentication system. The user may then select one piece of personalized authentication data for use by the system at a time of authentication.

Claims

1. A computer-implemented method for facilitating user authentication, the method comprising:

associating first non-textual authentication data with a user, wherein the first non-textual authentication data is provided by the user, and wherein the first non-textual authentication data is exclusive of biometric data of the user; and

authenticating the user based on the first non-textual authentication data.

2. The method of claim 1, wherein the first non-textual authentication data includes acoustic data.

3. The method of claim 2, wherein the acoustic data corresponds to a user-provided tone sequence or a user-provided audio clip.

4. The method of claim 1, wherein the first non-textual authentication data includes graphical data.

5. The method of claim 4, wherein the graphical data corresponds to a user-provided still image or a user-provided video clip.

6. The method of claim 1 further comprising:

storing the first non-textual authentication data on a device usable by the user; and

retrieving the first non-textual authentication data from the device at a time of authentication.

7. The method of claim 6, wherein authenticating the user is further based on one or more attributes of the device.

8. The method of claim 6, wherein the device is selected from a group consisting of a personal computer, a personal digital assistant (PDA), a smart card, a security token, and a mobile telephone.

9. The method of claim 1 further comprising:

associating second non-textual authentication data with the user, wherein the second non-textual authentication data is different from the first non-textual authentication data, and wherein the second non-textual authentication data is provided by the user; and

enabling selection of either the first non-textual authentication data or the second non-textual authentication data for use in authenticating the user.

10. The method of claim 1, wherein associating first non-textual authentication data with a user comprises:

receiving the first non-textual authentication data from the user; and

registering the first non-textual authentication data with an identity of the user in a registration database.

11. The method of claim 10, wherein the first non-textual authentication data is received via a computer network.

12. The method of claim 10, wherein the first non-textual authentication data is received via a voice-based network.

13. The method of claim 1, wherein authenticating the user based on the first non-textual authentication data comprises:

receiving input non-textual authentication data from the user; and

determining whether the input non-textual authentication data matches the first non-textual authentication data.

14. The method of claim 1, wherein authenticating the user based on the first non-textual authentication data comprises:

receiving a one-time password from the user, wherein the one-time password is derived from the first non-textual authentication data; and

authenticating the user based on the one-time password.

15. A system for facilitating user authentication, the system comprising:

a registration unit for registering non-textual authentication data with an identity of a user in a registration database, wherein the non-textual authentication data is provided by the user, and wherein the non-textual authentication data does not correspond to biometric data of the user; and

an authentication unit for authenticating the user based on the non-textual authentication data.

16. A machine-readable medium having stored thereon a series of instructions which, when executed by a processing component, cause the processing component to facilitate user authentication by:

associating non-textual authentication data with a user, wherein the non-textual authentication data is provided by the user, and wherein the non-textual authentication data does not correspond to biometric data of the user; and

authenticating the user based on the non-textual authentication data.