ACCESS CONTROL BY TESTING FOR SHARED KNOWLEDGE

• US 20090288150A1
• Filed: 05/14/2009
• Published: 11/19/2009
• Est. Priority Date: 05/16/2008
• Status: Active Grant

• Current Assignee: University of Washington
• Original Assignee: University of Washington
• Inventors: Kohno, Tadayoshi, Landay, James, Zhang, Xianhang, Morris, Nathan, Toomim, Michael, Fogarty, James
• Granted Patent: US 8,387,122 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2131 Lost password, e.g. recovery of lost or forgotten passwords

Abstract

Access to resource(s) intended to be shared with specific groups of individuals is controlled using concise tests of shared knowledge instead of (or in addition) to accounts and access control lists. Users can readily learn the concept and choose questions that will control the access by the desired group with little effort. Such questions can be relatively secure to guesses by those not intended to have access, particularly if the number of allowed guesses is relatively limited. Users can generally predict the security of their questions, but sometimes underestimate the ability of attackers to use Web searching or enumeration to discover answers. In such cases, the system can automatically discover weak questions and then suggest alternatives. By lowering the threshold to access control, shared knowledge tests can enable more types of information to acquire collaborative value on the Internet and on other types of networks.

Claims

1. A method for using a computing device to control access to a resource, wherein the access includes one or more of perceiving, modifying, creating, adding to, or deleting the resource, comprising the steps of:

(a) enabling a user desiring to provide access to the resource by a specific group of one or more persons who can interact with the computing device, to specify a shared knowledge question and to indicate one or more acceptable answers to the shared knowledge question, wherein the user creates the shared knowledge question so that only the specific group of one or more persons are likely to know an acceptable answer to the shared knowledge question;

(b) enabling a person desiring to access the resource to be presented with the shared knowledge question and to respond by entering a proposed answer to the shared knowledge question;

(c) using the computing device to automatically employ an inexact matching procedure to determine if the proposed answer at least inexactly matches any of the one or more acceptable answers sufficiently to enable the person to access the resource; and

(i) if so, enabling the person to access the resource;

else,

(ii) if not, denying the person access to the resource.

2. The method of claim 1, wherein the step of using the computing device to automatically employ an inexact matching algorithm comprises at least one of the steps of:

(a) automatically ignoring word variations between any of the one or more acceptable answers and the proposed answer, as defined by linguistic dimensions;

(b) automatically ignoring at least one extra word, if included in the proposed answer but not included in any of the one or more acceptable answers; and

(c) ignoring an order of plural words appearing in the proposed answer, so long as each word included in any of the one or more acceptable answers has a corresponding word in the proposed answer.

3. The method of claim 2, wherein the step of automatically ignoring word variations between any of the one or more acceptable answers and the proposed answer comprises the step of determining if any of one or more words in a proposed answer is a misspelling of a word in any of the one or more acceptable answers.

4. The method of claim 2, wherein the step of automatically ignoring at least one extra word if included in the proposed answer is carried out only if the proposed answer also includes each word comprising any one of the one or more acceptable answers.

5. The method of claim 1, further comprising the step of determining an indication of an identity of a person attempting to access the resource by answering the shared knowledge question, without requiring the person to input a name or other identification at or before that time.

6. The method of claim 5, wherein the step of determining the indication of the identity of the person comprises at least one of the steps of:

(a) automatically determining that the person has attempted to access the resource from an online account that is confirmed by the user as being authorized to guess an answer to the shared knowledge question, wherein the online account is associated with and indicates the identity of the person;

(b) automatically accessing a web browser cookie that is stored on a computing device being used by the person, the web browser cooking indicating the identity of the person; and

(c) automatically determining an Internet protocol (IP) address of the person who is attempting to access the resource, the IP address being associated with and indicating the identity of the person.

7. The method of claim 1, further comprising the steps of:

(a) determining an indication of an identity of each person who attempts to access the resource; and

(b) automatically maintaining an access log that includes a record of each attempt to access the resource, wherein the record includes the indication of the identity of the person making the attempt.

8. The method of claim 7, further comprising the steps of automatically imposing limits related to the number of incorrect proposed answers input by one or more persons to one or more shared knowledge questions;

and, based upon the number of incorrect proposed answers that exceed a limit, taking an action that affects further input of proposed answers.

9. The method of claim 8, further comprising at least one of the steps of:

(a) if a total number, I_g, of incorrect proposed answers made by any person having an indicated identity g, for all shared knowledge questions for which the person input a proposed answer exceeds a first predetermined limit X_g, disallowing any more attempts by the person having the indicated identity g, to input a proposed answer for any shared knowledge question;

(b) if a number, I_gq, of incorrect proposed answers made by the person having the indicated identity g, for a specific shared knowledge question q exceeds a second predetermined limit X_gq, disallowing any further attempts by the person having the indicated identity g to input a proposed answer for the specific shared knowledge question q by any person having the indicated identity g; and

(c) if a number I_q of incorrect proposed answers made by any person for the specific shared knowledge question q exceeds a third predetermined limit X_q, disallowing any further attempts by any person to input a proposed answer to the specific shared knowledge question q.

10. The method of claim 7, further comprising the steps of:

(a) using data in the access log that indicates an identity of the user who specified the shared knowledge question, and the indicated identity of each person who input an acceptable answer to the shared knowledge question, determining a measure of a number of successful attempts by one or more persons to answer shared knowledge questions specified by the user, by input of acceptable proposed answers; and

(b) using the computing device for determining a degree of relation function between the user and each person based in part on the number of successful attempts by the person to input an acceptable proposed answer to the shared knowledge questions of the user.

11. The method of claim 10, further comprising the step of using the computing device for determining the degree of relation between the user and a person, based in part on a number of successful attempts by the user to input an acceptable proposed answer to each of one or more shared knowledge questions that have been specified by the user to control access to one or more resources of the person.

12. The method of claim 11, further comprising the step of employing the degree of relation between the user and persons, using the computing device to automatically carry out at least one of the steps selected from the group of steps consisting of:

(a) determining whether to display information about one or more persons to the user based upon the degree of relation of each person to the user;

(b) determining whether an indication will be activated and presented to the user in regard to information received from one or more persons, based upon the degree of relation of each person to the user;

(c) determining a sort order for presenting items received from a plurality of persons based upon the degree of relation of each person to the user;

(d) combining the degree of relation with a different statistic to produce a parameter used to determine an action that is taken in regard to information presented to the user;

(e) identifying persons who are more trusted than others by the user, based upon the degree of relation of each person to the user; and

(f) defining social hubs that include the user and the plurality of persons, based upon the degree of relation between the user and the plurality of persons.

13. The method of claim 11, further comprising the step of using the computing device for applying a weighting function to shared knowledge questions for use in determining the degree of relation.

14. The method of claim 1, further comprising the step of using the same shared knowledge question to control access to a plurality of different resources at different sites accessible over a network.

15. The method of claim 1, further comprising the step of reusing a shared knowledge question that is part of a set of shared knowledge questions to which a person has previously input a proposed answer determined to be acceptable, when the person subsequently attempts to access the resource, in combination with at least one other shared knowledge question, wherein the shared knowledge question that is reused and at least the one other shared knowledge question must all be answered correctly, to determine if the person will be allowed access to the resource.

16. The method of claim 1, wherein a site includes a plurality of resources for which the user has chosen a plurality of shared knowledge questions for use by the computing device in determining the persons who are granted access to the resources, further comprising the step of enabling the user to associate one or more of the shared knowledge questions respectively with one or more specific resources, but without indicating to a person the resource to which the person will be granted access if the proposed answer input to any of the shared knowledge questions is acceptable, thereby effectively hiding the resource to which the person will be granted access until the proposed answer input by the person is determined by the computing device to be correct.

17. The method of claim 1, further comprising the steps of using the computing device for:

(a) automatically evaluating the shared knowledge question specified by the user to determine a likelihood that a person might be able to guess a proposed answer that is acceptable without actually having knowledge of any acceptable answer; and

(b) presenting a value that is indicative of said likelihood, to the user who is specifying the shared knowledge question, to provide a warning if it appears that the user has specified a shared knowledge question to which it is easy to guess a correct answer.

18. The method of claim 17, wherein the step of automatically evaluating comprises at least one step selected from a group of steps consisting of:

(a) determining if the acceptable answer to the shared knowledge question is a member of a set having only readily enumerable members;

(b) determining if the acceptable answer is readily discoverable by searching publicly available data; and

(c) determining if the shared knowledge question is included in a predefined database of easily answered shared knowledge questions.

19. The method of claim 1, further comprising the step of using the computing device for automatically suggesting a shared knowledge question to the user by carrying out one of the steps of:

(a) suggesting a category of shared knowledge questions based upon data that have been compiled about the user or about persons who have been identified as friends of the user;

(b) suggesting a shared knowledge question based upon data that have been compiled about the user or about the persons who have been identified as friends of the user;

(c) identifying interests of the user as a basis for suggesting a shared knowledge question;

(d) suggesting a shared knowledge question targeted to content that have been uploaded or downloaded by the user over a network; and

(e) suggesting a shared knowledge question derived from a database of shared knowledge questions that correspond to interests and activities of the user.

20. The method of claim 1, further comprising the steps of using the computing device for:

(a) enabling the user to specify a plurality of shared knowledge questions for controlling access to one or more resources; and

(b) enabling the user to specify at least one option selected from the group of options consisting of;

(i) a plurality of specific shared knowledge questions that must all be answered correctly by a person to gain access to one or more resources;

(ii) a Boolean combination of shared knowledge questions that must be answered correctly by a person to gain access to the one or more resources; and

(iii) a portion that is less than all of a plurality of shared knowledge questions that must be answered correctly by a person to gain access to the one or more resources.

21. A memory medium storing machine readable and executable instructions for use in controlling access to a resource, by carrying out a plurality of functions when the machine readable and executable instructions are executed on a computing device, wherein the access includes one or more of perceiving, modifying, creating, adding to, or deleting the resource, the plurality of functions including:

(a) enabling a user desiring to provide access to the resource by a specific group of one or more persons, to specify a shared knowledge question and to indicate one or more acceptable answers to the shared knowledge question, wherein the user creates the shared knowledge question so that only the specific group of one or more persons are likely to know an acceptable answer to the shared knowledge question;

(b) enabling a person desiring to access the resource to be presented with the shared knowledge question and to respond by entering a proposed answer to the shared knowledge question;

(c) automatically employing an inexact matching procedure to determine if the proposed answer at least inexactly matches any of the one or more acceptable answers sufficiently to enable the person access to the resource; and

(i) if so, enabling the person access to the resource;

else,

(ii) if not, denying the person access to the resource.

22. A method for using a computing device for controlling access to resources, wherein the access includes one or more of perceiving, modifying, creating, adding to, or deleting the resource, and in connection therewith, determining a degree of relation between parties accessing the resources, comprising the steps of:

(a) specifying shared knowledge questions and specifying one or more acceptable answers to each shared knowledge question, where each shared knowledge question is associated with a resource and is selected so that a group of one or more parties who are intended to be able to access the resource are likely to have knowledge of an acceptable answer to the shared knowledge question;

(b) enabling parties to enter proposed answers to shared knowledge questions that are each associated with specific resources;

(c) using the computing device for determining if the proposed answers that are entered by the parties are acceptable answers, and if so, granting access to the resources with which the shared knowledge questions answered by the parties are associated; and

(d) determining a degree of relation function between the user and a specific party who has attempted to access one or more resources by entering a proposed answer to each of one or more shared knowledge questions of the user, where the degree of relation function is at least in part based upon a number of successful attempts by a party to access the one or more resources of the user, by correctly answering the one or more shared knowledge questions.

23. The method of claim 22, wherein the parties also share resources and control access to the resources that they are sharing by specifying shared knowledge questions that must be successfully answered by entering an acceptable proposed answer, further comprising the steps of using the computing device for:

(a) determining a number of successful attempts by the user to enter an acceptable proposed answer to a shared knowledge question of a specific party and thereby gain access to the resource of the specific party; and

(b) further determining the degree of relationship between the user and the specific party based at least in part on the number of successful attempts by the user to access one or more resources of the specific party.

24. The method of claim 23, further comprising the step of using the computing device for applying weighting factors to the shared knowledge questions used in determining the degree of relation function.

25. The method of claim 22, further comprising the step of determining a portion of information of the user that will be shared with the specific party, based upon the degree of relation function between the user and the specific party.

26. The method of claim 22, further comprising the steps of determining whether the degree of relation function for the specific party is above a predefined threshold, and if above the predefined threshold, taking a predetermined action comprising at least one step selected from the group of steps consisting of:

(a) providing an indicia applied to data that are received from the specific party by the user, wherein the indicia is applied in a manner that is based upon the degree of relation function;

(b) determining a level of trust associated with the specific party in regard to accessing resources of the user, based upon the degree of relation function; and

(c) adding the specific party to a list of persons that is employed by the user for a desired purpose, based upon the degree of relation function.

27. The method of claim 26, further comprising the step of enabling the user to vary the predefined threshold to alter the degree of relation function that a specific party must have to access a resource of the user.

28. The method of claim 22, further comprising the step of using the degree of relation function of the specific party to determine if the specific party will be allowed access to other resources of the user.

29. The method of claim 22, further comprising the step of determining the degree of relation function for a plurality of specific parties relative to the user to determine members of a social hub.

30. A method for using a computing device for controlling access to resources over a network, wherein the access includes one or more of perceiving, modifying, creating, adding to, or deleting a resource, comprising the steps of:

(a) enabling one or more shared knowledge questions to be specified and specifying one or more acceptable answers to each shared knowledge question, where each shared knowledge question is associated with a first resource and is selected so that a specific group of one or more parties who are intended to be able to access the first resource are likely to have knowledge of an acceptable answer to the one or more shared knowledge questions;

(b) using the computing device for enabling a party attempting to access a second resource that is controlled by a different entity than that controlling the first resource to enter a proposed answer to one or more of the shared knowledge questions that are associated with the first resource, thereby reusing the one or more shared knowledge questions to control access to the second resource;

(c) using the computing device for determining if the one or more proposed answers that are entered by the party attempting to access the second resource are acceptable; and

(i) if so, granting the party access to the second resource;

else,

(ii) if not, denying the party access to the second resource.

31. The method of claim 30, further comprising the step of maintaining a storage that includes the one or more shared knowledge questions, wherein the storage is accessible over a network and the one or more shared knowledge questions included in the storage are associated with one or more specific parties who have accessed the first resource by entering acceptable answers to the one or more shared knowledge questions before the shared knowledge questions are reused to control access to the second resource, the party attempting to access the second resource being a member of the one or more specific parties who have successfully accessed the first resource.

32. The method of claim 31, further comprising the step of employing the one or more shared knowledge questions that are reused to control access to the second resource only if the party attempting to access the second resource has first failed to provide a predefined password initially required to access the second resource, or if there is at least one concern about granting the party access to the second resource based on use of only a different procedure for controlling access.

33. The method of claim 32, wherein the at least one concern is selected from the group of concerns consisting of:

(a) the second resource has a substantially higher value than other resources for which access is granted based only on the different procedure;

(b) a possible fraud by the party in attempting to access the second resource has been detected; and

(c) a suspect behavior has been detected in connection with an attempt by the party to access the second resource.

34. The method of claim 31, wherein the party attempting to access the second resource originally specified the one or more shared knowledge questions used to control access to the first resource.

35. The method of claim 31, further comprising the step of using the computing device for computing a probability that acceptable answers to each of the one or more shared knowledge questions can be successfully guessed, to aid in determining how many of the shared knowledge questions must be answered successfully before the party is allowed access to the second resource.

36. A method for using a computing device for controlling access to a plurality of resources, wherein the access includes one or more of perceiving, modifying, creating, adding to, or deleting a resource, comprising the steps of:

(a) enabling a plurality of different shared knowledge questions to be specified, wherein specific subsets of the plurality of shared knowledge questions are associated with specific subsets of the plurality of resources and are selected to enable specific groups of one or more parties to access specific resources with which the specific subsets of shared knowledge questions are associated;

(b) using the computing device for storing one or more acceptable answers to each of the plurality of shared knowledge questions that were specified;

(c) presenting a subset of the plurality of shared knowledge questions to a person communicating with the computing device, wherein an existence of the resources with which one or more subsets of the plurality of shared knowledge questions are associated, is hidden from the person;

(d) enabling the person to enter a proposed answer to any of the plurality of shared knowledge questions presented to the person;

(e) using the computing device for determining whether each proposed answer entered by the person is an acceptable answer to the shared knowledge questions for which the proposed answer was entered; and

(i) enabling the person access to the resource associated with any of the plurality of shared knowledge questions that the person successfully correctly answered, so that after being granted access, the existence of each resource to which the person has been granted access then becomes evident to the person;

else,

(ii) denying the person access to the resources associated with any shared knowledge questions that the person failed to successfully correctly answer, so that the resources remain hidden from the person.

37. A method for using a computing device to assist in controlling access to a resource, wherein the access includes one or more of perceiving, modifying, creating, adding to, or deleting the resource, comprising the steps of:

(a) using the computing device to suggest a shared knowledge question that will be used to control access to the resource;

(b) enabling one or more acceptable answers to the shared knowledge question to be specified; and

(c) presenting the shared knowledge question to a person desiring to access the resource, to control access to the resource based upon the answer provided by the person to the shared knowledge question.

38. A system for controlling access to a resource, wherein the access includes one or more of perceiving, modifying, creating, adding to, or deleting a resource, comprising:

(a) a memory in which information related to the resource or for accessing it, and machine executable instructions are stored;

(b) an interface for enabling bi-directional communication with a computing device used by a party attempting to access the resource; and

(c) a processor that is coupled to the memory and to the interface, the processor executing the machine executable instructions stored in the memory to carry out a plurality of functions, including;

(i) facilitating a user specifying a shared knowledge question with which one or more acceptable answers are associated, the shared knowledge question being specified so that only a specific group of one or more persons is likely to know an acceptable answer to the shared knowledge question;

(ii) presenting the shared knowledge question to a person desiring to access the resource;

(iii) accepting entry of a proposed answer to the shared knowledge question by the person;

(iv) employing an inexact matching procedure to determine if the proposed answer at least inexactly matches any of the one or more acceptable answers sufficiently to enable the person access to the resource; and

(A) if so, enabling the person access to the resource via the interface;

else

(B) if not, denying the person access to the resource.

39. A system for controlling access to resources, wherein the access includes one or more of perceiving, modifying, creating, adding to, or deleting a resource, and in connection therewith, determining a degree of relationship between parties accessing the resources, comprising:

(a) a memory in which information related to the resources or information for accessing the resources, and machine executable instructions are stored;

(b) an interface for enabling bi-directional communication with computing devices used by parties to attempt to access the resources; and

(c) a processor in communication with the memory and with the interface, the processor executing the machine executable instructions to carry out a plurality of functions, including;

(i) facilitating specification of shared knowledge questions, and association of one or more acceptable answers to each shared knowledge question, where each shared knowledge question is also associated with a resource and is specified so that a specific group of one or more parties who are intended to be able to access the resources are likely to have knowledge of acceptable answers to the shared knowledge question;

(ii) presenting shared knowledge questions to parties desiring to access specific resources;

(iii) accepting entry of proposed answers to shared knowledge questions that are associated with specific resources;

(iv) determining if the proposed answers that are entered by the parties are acceptable answers, and if so, granting access to the resources with which the shared knowledge questions answered by the parties are associated; and

(v) determining a degree of relation function between a user and a specific party who has attempted to access one or more resources of the user by entering a proposed answer to each of one or more shared knowledge questions, where the degree of relation function is at least in part based upon a number of successful attempts by the specific party to access the one or more resources by correctly answering the one or more shared knowledge questions.

40. A system for reusing shared knowledge questions originally created for controlling access to a first resource to be used for controlling access to a second resource, wherein the access includes one or more of perceiving, modifying, creating, adding to, or deleting a resource, comprising:

(a) a memory in which information related to the second resource or for accessing it, and machine executable instructions are stored;

(b) an interface for enabling bi-directional communication with computing devices used by parties to attempt to access the second resource; and

(c) a processor that is coupled to the memory and to the interface, the processor executing the machine executable instructions stored in the memory to carry out a plurality of functions, including;

(i) using the interface to access data at a different site, where the data at the different site were produced as a result of a first user specifying one or more shared knowledge questions that are each associated with one or more acceptable answers, wherein each shared knowledge question is associated with a first resource and is selected so that specific groups of one or more of the parties who are intended to be able to access the first resource are likely to have knowledge of an acceptable answer to the one or more shared knowledge questions;

(ii) enabling a party attempting to access the second resource to enter a proposed answer to each of the one or more shared knowledge questions that are associated with the first resource, thereby reusing the one or more shared knowledge questions to control access to the second resource;

(iii) determining if the one or more proposed answers that are entered by the party attempting to access the second resource are acceptable; and

(A) if so, granting the party access to the second resource;

else,

(B) if not, denying the party access to the second resource.

41. A system for controlling access to a plurality of resources, wherein the access includes one or more of perceiving, modifying, creating, adding to, or deleting a resource, comprising:

(a) a memory in which information related to the plurality of resources or information for accessing the plurality of resources, and machine executable instructions are stored;

(b) an interface for enabling bi-directional communication with computing devices used by parties to attempt to access the plurality of resources; and

(c) a processor in communication with the memory and with the interface, the processor executing the machine executable instructions to carry out a plurality of functions, including;

(i) facilitating specification of a plurality of different shared knowledge questions, wherein specific subsets of the shared knowledge questions are associated with specific subsets of the plurality of resources and are selected to enable specific groups of one or more parties to access the resources with which subsets of the shared knowledge questions are associated, wherein each shared knowledge question is associated with one or more acceptable answers;

(ii) presenting a subset of the plurality of shared knowledge questions to a person communicating with the processor through the interface, wherein an existence of the specific resource with which subset of the plurality of shared knowledge questions is associated, is hidden from the person;

(iii) accepting entry by the person of a proposed answer to any of the plurality of shared knowledge questions that have been presented to the person;

(iv) determining whether each proposed answer entered by the person is an acceptable answer to the shared knowledge questions for which the proposed answer was entered; and

(A) enabling the person access to the resource associated with each of the plurality of shared knowledge questions that the person successfully answered, so that after being granted access, the existence of each resource to which the person has been granted access becomes evident to the person;

else,

(B) denying the person access to the resource associated with any shared knowledge questions that the person failed to successfully answer, so that the resource remains hidden from the person.